Concurrency support for PNaCl ABI

lib/Analysis/NaCl/PNaClABIVerifyFunctions.cpp

 //===- PNaClABIVerifyFunctions.cpp - Verify PNaCl ABI rules ---------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // Verify function-level PNaCl ABI requirements.
 //
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/ADT/Twine.h"
 #include "llvm/Analysis/NaCl.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/IntrinsicInst.h"
 #include "llvm/IR/LLVMContext.h"
 #include "llvm/IR/Metadata.h"
+#include "llvm/IR/NaClIntrinsics.h"
 #include "llvm/IR/Operator.h"
 #include "llvm/Pass.h"
 #include "llvm/Support/raw_ostream.h"
 
 #include "PNaClABITypeChecker.h"
 using namespace llvm;
 
 namespace {
 
 // Checks that examine anything in the function body should be in
@@ skipping 14 matching lines @@
     initializePNaClABIVerifyFunctionsPass(*PassRegistry::getPassRegistry());
   }
   ~PNaClABIVerifyFunctions() {
     if (ReporterIsOwned)
       delete Reporter;
   }
   bool runOnFunction(Function &F);
   virtual void print(raw_ostream &O, const Module *M) const;
  private:
   bool IsWhitelistedMetadata(unsigned MDKind);
-  const char *checkInstruction(const Instruction *Inst);
+  const char *checkInstruction(LLVMContext &C, const NaCl::AtomicIntrinsics &AI,
+                               const Instruction *Inst);
   PNaClABIErrorReporter *Reporter;
   bool ReporterIsOwned;
 };
 
 } // and anonymous namespace
 
 // There's no built-in way to get the name of an MDNode, so use a
 // string ostream to print it.
 static std::string getMDNodeString(unsigned Kind,
                                    const SmallVectorImpl<StringRef> &MDNames) {
@@ skipping 70 matching lines @@
   if (isa<Instruction>(Val) || isa<Argument>(Val) || isa<BasicBlock>(Val))
     return true;
 
   // Allow some Constants.  Note that this excludes ConstantExprs.
   return PNaClABITypeChecker::isValidScalarType(Val->getType()) &&
          (isa<ConstantInt>(Val) ||
           isa<ConstantFP>(Val) ||
           isa<UndefValue>(Val));
 }
 
-static bool isAllowedAlignment(unsigned Alignment, Type *Ty, bool IsAtomic) {
-  if (IsAtomic) {
-    // For atomic operations, the alignment must match the size of the type.
-    if (Ty->isIntegerTy()) {
-      unsigned Bits = Ty->getIntegerBitWidth();
-      return Bits % 8 == 0 && Alignment == Bits / 8;
-    }
-    return (Ty->isDoubleTy() && Alignment == 8) ||
-           (Ty->isFloatTy() && Alignment == 4);
-  }
+static bool isAllowedAlignment(unsigned Alignment, Type *Ty) {
   // Non-atomic integer operations must always use "align 1", since we
   // do not want the backend to generate code with non-portable
   // undefined behaviour (such as misaligned access faults) if user
   // code specifies "align 4" but uses a misaligned pointer.  As a
   // concession to performance, we allow larger alignment values for
   // floating point types.
   //
   // To reduce the set of alignment values that need to be encoded in
   // pexes, we disallow other alignment values.  We require alignments
   // to be explicit by disallowing Alignment == 0.
   return Alignment == 1 ||
          (Ty->isDoubleTy() && Alignment == 8) ||
          (Ty->isFloatTy() && Alignment == 4);
 }
 
+static bool hasAllowedAtomicRMWOperation(
+    NaCl::AtomicIntrinsics::const_iterator AI, const CallInst *Call) {
+  for (size_t P = 0; P != AI->NumParams; ++P) {
+    if (AI->ParamType[P] != NaCl::AtomicIntrinsics::RMW)
+      continue;
+
+    const Value *Operation = Call->getOperand(P);
+    if (!Operation)
+      return false;
+    const Constant *C = dyn_cast<Constant>(Operation);
+    if (!C)
+      return false;
+    const APInt &I = C->getUniqueInteger();
+    if (I.ule(NaCl::AtomicInvalid) || I.uge(NaCl::AtomicNum))
+      return false;
+  }
+  return true;
+}
+
+static bool hasAllowedAtomicMemoryOrder(
+    NaCl::AtomicIntrinsics::const_iterator AI, const CallInst *Call) {
+  for (size_t P = 0; P != AI->NumParams; ++P) {
+    if (AI->ParamType[P] != NaCl::AtomicIntrinsics::Mem)
+      continue;
+
+    const Value *MemoryOrder = Call->getOperand(P);
+    if (!MemoryOrder)
+      return false;
+    const Constant *C = dyn_cast<Constant>(MemoryOrder);
+    if (!C)
+      return false;
+    const APInt &I = C->getUniqueInteger();
+    if (I.ule(NaCl::MemoryOrderInvalid) || I.uge(NaCl::MemoryOrderNum))
+      return false;
+    // TODO For now only sequential consistency is allowed. When more
+    //      are allowed we need to validate that the memory order is
+    //      allowed on the specific atomic operation (e.g. no store
+    //      acquire, and relationship between success/failure memory
+    //      order on compare exchange).
+    if (I != NaCl::MemoryOrderSequentiallyConsistent)
+      return false;
+  }
+  return true;
+}
+
 // Check the instruction's opcode and its operands.  The operands may
 // require opcode-specific checking.
 //
 // This returns an error string if the instruction is rejected, or
 // NULL if the instruction is allowed.
-const char *PNaClABIVerifyFunctions::checkInstruction(const Instruction *Inst) {
+const char *PNaClABIVerifyFunctions::checkInstruction(LLVMContext &C,

[eliben, 2013/07/03 16:06:05]

I think you should not carry the Context and AtomicIntrinsics into this method
just for the sake of verifying intrinsics. Moreover, below in runOnFunction you
do:

NaCl::AtomicIntrinsics AI(C);

Recreating it for each function the pass runs on. Why? It would be both cleaner
and more efficient to have "AI" a member of this pass, initialized in the pass
constructor, and checkInstruction then also doesn't need to have these passed
in.

[JF, 2013/07/03 20:58:35]

Done.

+    const NaCl::AtomicIntrinsics &AI, const Instruction *Inst) {
   // If the instruction has a single pointer operand, PtrOperandIndex is
   // set to its operand index.
   unsigned PtrOperandIndex = -1;
 
   switch (Inst->getOpcode()) {
     // Disallowed instructions. Default is to disallow.
     // We expand GetElementPtr out into arithmetic.
     case Instruction::GetElementPtr:
     // VAArg is expanded out by ExpandVarArgs.
     case Instruction::VAArg:
     // Zero-cost C++ exception handling is not supported yet.
     case Instruction::Invoke:
     case Instruction::LandingPad:
     case Instruction::Resume:
     // indirectbr may interfere with streaming
     case Instruction::IndirectBr:
     // No vector instructions yet
     case Instruction::ExtractElement:
     case Instruction::InsertElement:
     case Instruction::ShuffleVector:
     // ExtractValue and InsertValue operate on struct values.
     case Instruction::ExtractValue:
     case Instruction::InsertValue:
+    // Atomics should become NaCl intrinsics.
+    case Instruction::AtomicCmpXchg:
+    case Instruction::AtomicRMW:
+    case Instruction::Fence:
       return "bad instruction opcode";
     default:
       return "unknown instruction opcode";
 
     // Terminator instructions
     case Instruction::Ret:
     case Instruction::Br:
     case Instruction::Unreachable:
     // Binary operations
     case Instruction::FAdd:
     case Instruction::FSub:
     case Instruction::FMul:
     case Instruction::FDiv:
     case Instruction::FRem:
     // Bitwise binary operations
     case Instruction::And:
     case Instruction::Or:
     case Instruction::Xor:
-    // Memory instructions
-    case Instruction::Fence:
     // Conversion operations
     case Instruction::Trunc:
     case Instruction::ZExt:
     case Instruction::SExt:
     case Instruction::FPTrunc:
     case Instruction::FPExt:
     case Instruction::FPToUI:
     case Instruction::FPToSI:
     case Instruction::UIToFP:
     case Instruction::SIToFP:
@@ skipping 18 matching lines @@
     case Instruction::Shl:
     case Instruction::LShr:
     case Instruction::AShr:
       if (Inst->getOperand(0)->getType()->isIntegerTy(1))
         return "arithmetic on i1";
       break;
 
     // Memory accesses.
     case Instruction::Load: {
       const LoadInst *Load = cast<LoadInst>(Inst);
+      PtrOperandIndex = Load->getPointerOperandIndex();
+      if (Load->isAtomic())
+        return "atomic";

[eliben, 2013/07/03 16:06:05]

Maybe "atomic load" / "volatile load", etc? Same below for store

[JF, 2013/07/03 20:58:35]

Done. It's a bit redundant: see my corresponding change in instructions.ll (it
relies on that message).

 ; CHECK: disallowed: atomic load: {{.*}} load atomic
  %a2 = load atomic i32* %ptr seq_cst, align 4
; CHECK: disallowed: volatile load: {{.*}} load volatile
  %a3 = load volatile i32* %ptr, align 4
; CHECK: disallowed: atomic store: store atomic
  store atomic i32 undef, i32* %ptr seq_cst, align 4
; CHECK: disallowed: volatile store: store volatile
  store volatile i32 undef, i32* %ptr, align 4

+      if (Load->isVolatile())
+        return "volatile";
       if (!isAllowedAlignment(Load->getAlignment(),
-                              Load->getType(),
-                              Load->isAtomic()))
+                              Load->getType()))
         return "bad alignment";
-      PtrOperandIndex = 0;
       if (!isNormalizedPtr(Inst->getOperand(PtrOperandIndex)))
         return "bad pointer";
       break;
     }
     case Instruction::Store: {
       const StoreInst *Store = cast<StoreInst>(Inst);
+      PtrOperandIndex = Store->getPointerOperandIndex();
+      if (Store->isAtomic())
+        return "atomic";
+      if (Store->isVolatile())
+        return "volatile";
       if (!isAllowedAlignment(Store->getAlignment(),
-                              Store->getValueOperand()->getType(),
-                              Store->isAtomic()))
+                              Store->getValueOperand()->getType()))
         return "bad alignment";
-      PtrOperandIndex = 1;
       if (!isNormalizedPtr(Inst->getOperand(PtrOperandIndex)))
         return "bad pointer";
       break;
     }
-    case Instruction::AtomicCmpXchg:
-    case Instruction::AtomicRMW:
-      PtrOperandIndex = 0;
-      if (!isNormalizedPtr(Inst->getOperand(PtrOperandIndex)))
-        return "bad pointer";
-      break;
 
     // Casts.
     case Instruction::BitCast:
       if (Inst->getType()->isPointerTy()) {
         PtrOperandIndex = 0;
         if (!isInherentPtr(Inst->getOperand(PtrOperandIndex)))
           return "operand not InherentPtr";
       }
       break;
     case Instruction::IntToPtr:
@@ skipping 30 matching lines @@
       // metadata arguments, so handle them specially.
       if (const IntrinsicInst *Call = dyn_cast<IntrinsicInst>(Inst)) {
         for (unsigned ArgNum = 0, E = Call->getNumArgOperands();
              ArgNum < E; ++ArgNum) {
           const Value *Arg = Call->getArgOperand(ArgNum);
           if (!(isValidScalarOperand(Arg) ||
                 isNormalizedPtr(Arg) ||
                 isa<MDNode>(Arg)))
             return "bad intrinsic operand";
         }
+
         // Disallow alignments other than 1 on memcpy() etc., for the
         // same reason that we disallow them on integer loads and
         // stores.
         if (const MemIntrinsic *MemOp = dyn_cast<MemIntrinsic>(Call)) {
           // Avoid the getAlignment() method here because it aborts if
           // the alignment argument is not a Constant.
           Value *AlignArg = MemOp->getArgOperand(3);
           if (!isa<ConstantInt>(AlignArg) ||
               cast<ConstantInt>(AlignArg)->getZExtValue() != 1) {
             return "bad alignment";
           }
         }
+
+        // Disallow NaCl atomic intrinsics which don't have valid
+        // constant NaCl::AtomicOperation and NaCl::MemoryOrder
+        // parameters.
+        switch (Call->getIntrinsicID()) {
+          default: break;  // Non-atomic intrinsic.
+          case Intrinsic::nacl_atomic_load:
+          case Intrinsic::nacl_atomic_store:
+          case Intrinsic::nacl_atomic_rmw:
+          case Intrinsic::nacl_atomic_cmpxchg:
+          case Intrinsic::nacl_atomic_fence: {
+            NaCl::AtomicIntrinsics::const_iterator I =
+                AI.find(Call->getIntrinsicID(), Type::getInt32Ty(C));
+            if (!hasAllowedAtomicMemoryOrder(I, Call))
+              return "invalid memory order";
+            if (!hasAllowedAtomicRMWOperation(I, Call))
+              return "invalid atomicRMW operation";
+          } break;
+        }
+
         // Allow the instruction and skip the later checks.
         return NULL;
       }
 
       // The callee is the last operand.
       PtrOperandIndex = Inst->getNumOperands() - 1;
       if (!isNormalizedPtr(Inst->getOperand(PtrOperandIndex)))
         return "bad function callee operand";
       break;
     }
@@ skipping 50 matching lines @@
     if (Op->isExact())
       return "has \"exact\" attribute";
   }
 
   // Allow the instruction.
   return NULL;
 }
 
 bool PNaClABIVerifyFunctions::runOnFunction(Function &F) {
   SmallVector<StringRef, 8> MDNames;
-  F.getContext().getMDKindNames(MDNames);
+  LLVMContext &C = F.getContext();
+  C.getMDKindNames(MDNames);
+
+  NaCl::AtomicIntrinsics AI(C);
 
   for (Function::const_iterator FI = F.begin(), FE = F.end();
            FI != FE; ++FI) {
     for (BasicBlock::const_iterator BBI = FI->begin(), BBE = FI->end();
              BBI != BBE; ++BBI) {
       const Instruction *Inst = BBI;
       // Check the instruction opcode first.  This simplifies testing,
       // because some instruction opcodes must be rejected out of hand
       // (regardless of the instruction's result type) and the tests
       // check the reason for rejection.
-      const char *Error = checkInstruction(BBI);
+      const char *Error = checkInstruction(C, AI, BBI);
       // Check the instruction's result type.
       if (!Error && !(PNaClABITypeChecker::isValidScalarType(Inst->getType()) ||
                       isNormalizedPtr(Inst) ||
                       isa<AllocaInst>(Inst))) {
         Error = "bad result type";
       }
       if (Error) {
         Reporter->addError() << "Function " << F.getName() <<
           " disallowed: " << Error << ": " << *BBI << "\n";
       }
@@ skipping 27 matching lines @@
 }
 
 char PNaClABIVerifyFunctions::ID = 0;
 INITIALIZE_PASS(PNaClABIVerifyFunctions, "verify-pnaclabi-functions",
                 "Verify functions for PNaCl", false, true)
 
 FunctionPass *llvm::createPNaClABIVerifyFunctionsPass(
     PNaClABIErrorReporter *Reporter) {
   return new PNaClABIVerifyFunctions(Reporter);
 }