Port MemorySanitizer.cpp (compiler transform) to Android

[thurston]

Summary

Change the LLVM instrumentation pass to match the corresponding changes (D23369) to external/compiler-rt/lib/msan i.e., accesses the MsanTLSSlot using either TLS_SLOT_TSAN (on Android) or original __thread variables (on non-Android).

[thurston]

#define SANITIZER_ANDROID is just a serving suggestion

[thurston]

Reuploaded with context

[thurston]

This emits the TLS access code inline:

• using Intrinsic::thread_pointer and TLS_SLOT_TSAN if on Android
• using the regular GlobalVariable::InitialExecTLSModel if on non-Android

to match the changes in D23369.

i.e., compared to the previous diff, this avoids the function calls in the generated code, and the copious #if SANITIZER_ANDROID throughout this source file.

[eugenis]

Transforms/Instrumentation/MemorySanitizer.cpp

498 ↗

(On Diff #67586)

This would emit a call to llvm.thread.pointer for each TLS access. Please check that they are optimized out and the final assembly does not do the extra loads of TLS_SLOT_TSAN - and if it does, change the IR to call thread.pointer only once per function.

505 ↗

(On Diff #67586)

As per the comment in the compiler-rt review, we need to keep the old TLS variables on non-Android.

510 ↗

(On Diff #67586)

These should be named constants.

[thurston]

Matches the changes in D23369, to use TLS_SLOT_TSAN only on Android (use the original variables on non-Android platforms).
Also adds named constants offsetof__msan_param_tls etc.

Now the bad news: it does actually TLS_SLOT_TSAN many times within a function. I've done some refactoring to cache the value, but it's broken.

MemorySanitizer.cpp

 
 // These constants must be kept in sync with the ones in msan.h.
 static const unsigned kParamTLSSize = 800;
 static const unsigned kRetvalTLSSize = 800;
 
 // Accesses sizes are powers of two: 1, 2, 4, 8.
 static const size_t kNumberOfAccessSizes = 4;
 
+// Used on Android only: the offsets of these variables in struct MsanTLSSlot
+// These offsets are statically asserted in msan_linux.cc
+// (MsanThread *GetCurrentThread())
+static const unsigned offsetof__msan_param_tls = 0;
+static const unsigned offsetof__msan_retval_tls = 1600;
+static const unsigned offsetof__msan_param_origin_tls = 800;
+static const unsigned offsetof__msan_retval_origin_tls = 2424;
+static const unsigned offsetof__msan__va_arg_tls = 2448;
+static const unsigned offsetof__msan_va_arg_overflow_size_tls = 2432;
+static const unsigned offsetof__msan_origin_tls = 2428;
+
 /// \brief Track origins of uninitialized values.
 ///
 /// Adds a section to MemorySanitizer report that points to the allocation
 /// (stack or heap) the uninitialized bits came from originally.
 static cl::opt<int> ClTrackOrigins("msan-track-origins",
        cl::desc("Track origins (allocation sites) of poisoned memory"),
        cl::Hidden, cl::init(0));
 static cl::opt<bool> ClKeepGoing("msan-keep-going",
public:
   const char *getPassName() const override { return "MemorySanitizer"; }
   void getAnalysisUsage(AnalysisUsage &AU) const override {
     AU.addRequired<TargetLibraryInfoWrapperPass>();
   }
   bool runOnFunction(Function &F) override;
   bool doInitialization(Module &M) override;
   static char ID;  // Pass identification, replacement for typeid.
 
+  Value* getAndroidTLSStructEntry(IRBuilder<> &IRB, unsigned long offset);
+
+  Value* getParamTLS(IRBuilder<> &IRB);
+  Value* getRetvalTLS(IRBuilder<> &IRB);
+  Value* getParamOriginTLS(IRBuilder<> &IRB);
+  Value* getRetvalOriginTLS(IRBuilder<> &IRB);
+  Value* getVAArgTLS(IRBuilder<> &IRB);
+  Value* getVAArgOverflowSizeTLS(IRBuilder<> &IRB);
+  Value* getOriginTLS(IRBuilder<> &IRB);
+
  private:
   void initializeCallbacks(Module &M);
 
   /// \brief Track origins (allocation points) of uninitialized values.
   int TrackOrigins;
 
   LLVMContext *C;
   Type *IntptrTy;
private:
   GlobalVariable *VAArgTLS;
   /// \brief Thread-local shadow storage for va_arg overflow area
   /// (x86_64-specific).
   GlobalVariable *VAArgOverflowSizeTLS;
   /// \brief Thread-local space used to pass origin value to the UMR reporting
   /// function.
   GlobalVariable *OriginTLS;
 
+  bool isAndroid;
+  Value *AndroidTLSStruct;
+
+  // \brief Defined as 'static THREADLOCAL MsanTLSSlot' for non-Android.
+  Value *MsanTLSSlot;
+
   /// \brief The run-time callback to print a warning.
   Value *WarningFn;
   // These arrays are indexed by log2(AccessSize).
   Value *MaybeWarningFn[kNumberOfAccessSizes];
   Value *MaybeStoreOriginFn[kNumberOfAccessSizes];
 
   /// \brief Run-time helper that generates a new origin value for a stack
   /// allocation.
MemmoveFn = M.getOrInsertFunction(
     IRB.getInt8PtrTy(), IntptrTy, nullptr);
   MemcpyFn = M.getOrInsertFunction(
     "__msan_memcpy", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
     IntptrTy, nullptr);
   MemsetFn = M.getOrInsertFunction(
     "__msan_memset", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IRB.getInt32Ty(),
     IntptrTy, nullptr);
 
+  if (!isAndroid) {
     // Create globals.
     RetvalTLS = new GlobalVariable(
       M, ArrayType::get(IRB.getInt64Ty(), kRetvalTLSSize / 8), false,
       GlobalVariable::ExternalLinkage, nullptr, "__msan_retval_tls", nullptr,
       GlobalVariable::InitialExecTLSModel);
     RetvalOriginTLS = new GlobalVariable(
       M, OriginTy, false, GlobalVariable::ExternalLinkage, nullptr,
       "__msan_retval_origin_tls", nullptr, GlobalVariable::InitialExecTLSModel);
 
     ParamTLS = new GlobalVariable(
       M, ArrayType::get(IRB.getInt64Ty(), kParamTLSSize / 8), false,
       GlobalVariable::ExternalLinkage, nullptr, "__msan_param_tls", nullptr,
       GlobalVariable::InitialExecTLSModel);
     ParamOriginTLS = new GlobalVariable(
       M, ArrayType::get(OriginTy, kParamTLSSize / 4), false,
       GlobalVariable::ExternalLinkage, nullptr, "__msan_param_origin_tls",
       nullptr, GlobalVariable::InitialExecTLSModel);
 
     VAArgTLS = new GlobalVariable(
       M, ArrayType::get(IRB.getInt64Ty(), kParamTLSSize / 8), false,
       GlobalVariable::ExternalLinkage, nullptr, "__msan_va_arg_tls", nullptr,
       GlobalVariable::InitialExecTLSModel);
     VAArgOverflowSizeTLS = new GlobalVariable(
       M, IRB.getInt64Ty(), false, GlobalVariable::ExternalLinkage, nullptr,
       "__msan_va_arg_overflow_size_tls", nullptr,
       GlobalVariable::InitialExecTLSModel);
     OriginTLS = new GlobalVariable(
       M, IRB.getInt32Ty(), false, GlobalVariable::ExternalLinkage, nullptr,
       "__msan_origin_tls", nullptr, GlobalVariable::InitialExecTLSModel);
+  }
 
   // We insert an empty inline asm after __msan_report* to avoid callback merge.
   EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
                             StringRef(""), StringRef(""),
                             /*hasSideEffects=*/true);
 }
 
+// Only used if isAndroid
+// Emits code equivalent to ((char*)GetMsanTls() + offset)
+// i.e., (char*)(__get_tls()[TLS_SLOT_TSAN])+offset
+Value* MemorySanitizer::getAndroidTLSStructEntry(IRBuilder<> &IRB, unsigned long offset) {
+  Value *AndroidTLSStruct0 = AndroidTLSStruct;
+  // Reset in MemorySanitizerVisitor::runOnFunction
+  if (AndroidTLSStruct == nullptr) {
+    // Based on AArch64TargetLowering::getIRStackGuard
+    // TLS_SLOT_TSAN = 8
+    const unsigned TlsOffset = 0x40;
+    Module *M = IRB.GetInsertBlock()->getParent()->getParent();
+    Function *ThreadPointerFunc =
+        Intrinsic::getDeclaration(M, Intrinsic::thread_pointer);
+    AndroidTLSStruct0 =
+      IRB.CreateLoad(
+        IRB.CreatePointerCast(
+          IRB.CreateConstGEP1_32(IRB.CreateCall(ThreadPointerFunc), TlsOffset),
+          Type::getInt8PtrTy(IRB.getContext())->getPointerTo(0)));
+    // AndroidTLSStruct = AndroidTLSStruct0;
+  }
+
+  Value *Base = IRB.CreatePointerCast(AndroidTLSStruct0, IntptrTy);
+  Base = IRB.CreateAdd(Base, ConstantInt::get(IntptrTy, offset));
+  return IRB.CreateIntToPtr(Base, PointerType::get(IntptrTy, 0));
+}
+
+Value* MemorySanitizer::getParamTLS(IRBuilder<> &IRB) {
+  if (isAndroid) {
+    return getAndroidTLSStructEntry (IRB, offsetof__msan_param_tls);
+  } else {
+    return ParamTLS;
+  }
+}
+
+Value* MemorySanitizer::getRetvalTLS(IRBuilder<> &IRB) {
+  if (isAndroid) {
+    return getAndroidTLSStructEntry (IRB, offsetof__msan_retval_tls);
+  } else {
+    return RetvalTLS;
+  }
+}
+
+Value* MemorySanitizer::getParamOriginTLS(IRBuilder<> &IRB) {
+  if (isAndroid) {
+    return getAndroidTLSStructEntry (IRB, offsetof__msan_param_origin_tls);
+  } else {
+    return ParamOriginTLS;
+  }
+}
+
+Value* MemorySanitizer::getRetvalOriginTLS(IRBuilder<> &IRB) {
+  if (isAndroid) {
+    return getAndroidTLSStructEntry (IRB, offsetof__msan_retval_origin_tls);
+  } else {
+    return RetvalOriginTLS;
+  }
+}
+
+Value* MemorySanitizer::getVAArgTLS(IRBuilder<> &IRB) {
+  if (isAndroid) {
+    return getAndroidTLSStructEntry (IRB, offsetof__msan__va_arg_tls);
+  } else {
+    return VAArgTLS;
+  }
+}
+
+Value* MemorySanitizer::getVAArgOverflowSizeTLS(IRBuilder<> &IRB) {
+  if (isAndroid) {
+    return getAndroidTLSStructEntry (IRB, offsetof__msan_va_arg_overflow_size_tls);
+  } else {
+    return VAArgOverflowSizeTLS;
+  }
+}
+
+Value* MemorySanitizer::getOriginTLS(IRBuilder<> &IRB) {
+  if (isAndroid) {
+    return getAndroidTLSStructEntry (IRB, offsetof__msan_origin_tls);
+  } else {
+    return OriginTLS;
+  }
+}
+
 /// \brief Module-level initialization.
 ///
 /// inserts a call to __msan_init to the module's constructor list.
 bool MemorySanitizer::doInitialization(Module &M) {
   auto &DL = M.getDataLayout();
 
   Triple TargetTriple(M.getTargetTriple());
   switch (TargetTriple.getOS()) {
case Triple::Linux:
           break;
         default:
           report_fatal_error("unsupported architecture");
       }
       break;
     default:
       report_fatal_error("unsupported operating system");
   }
+  isAndroid = TargetTriple.isAndroid();
 
   C = &(M.getContext());
   IRBuilder<> IRB(*C);
   IntptrTy = IRB.getIntPtrTy(DL);
   OriginTy = IRB.getInt32Ty();
 
   ColdCallWeights = MDBuilder(*C).createBranchWeights(1, 1000);
   OriginStoreWeights = MDBuilder(*C).createBranchWeights(1, 1000);
void materializeOneCheck(Instruction *OrigIns, Value *Shadow, Value *Origin,
     Value *ConvertedShadow = convertToShadowTyNoVec(Shadow, IRB);
     DEBUG(dbgs() << "  SHAD1 : " << *ConvertedShadow << "\n");
 
     Constant *ConstantShadow = dyn_cast_or_null<Constant>(ConvertedShadow);
     if (ConstantShadow) {
       if (ClCheckConstantShadow && !ConstantShadow->isZeroValue()) {
         if (MS.TrackOrigins) {
           IRB.CreateStore(Origin ? (Value *)Origin : (Value *)IRB.getInt32(0),
-                          MS.OriginTLS);
+                          MS.getOriginTLS(IRB));
         }
         IRB.CreateCall(MS.WarningFn, {});
         IRB.CreateCall(MS.EmptyAsm, {});
         // FIXME: Insert UnreachableInst if !ClKeepGoing?
         // This may invalidate some of the following checks and needs to be done
         // at the very end.
       }
       return;
if (AsCall && SizeIndex < kNumberOfAccessSizes) {
                                     getCleanShadow(ConvertedShadow), "_mscmp");
       Instruction *CheckTerm = SplitBlockAndInsertIfThen(
           Cmp, OrigIns,
           /* Unreachable */ !ClKeepGoing, MS.ColdCallWeights);
 
       IRB.SetInsertPoint(CheckTerm);
       if (MS.TrackOrigins) {
         IRB.CreateStore(Origin ? (Value *)Origin : (Value *)IRB.getInt32(0),
-                        MS.OriginTLS);
+                        MS.getOriginTLS(IRB));
       }
       IRB.CreateCall(MS.WarningFn, {});
       IRB.CreateCall(MS.EmptyAsm, {});
       DEBUG(dbgs() << "  CHECK: " << *Cmp << "\n");
     }
   }
 
   void materializeChecks(bool InstrumentWithCalls) {
     for (const auto &ShadowData : InstrumentationList) {
       Instruction *OrigIns = ShadowData.OrigIns;
       Value *Shadow = ShadowData.Shadow;
       Value *Origin = ShadowData.Origin;
       materializeOneCheck(OrigIns, Shadow, Origin, InstrumentWithCalls);
     }
     DEBUG(dbgs() << "DONE:\n" << F);
   }
 
   /// \brief Add MemorySanitizer instrumentation to a function.
   bool runOnFunction() {
+    MS.AndroidTLSStruct = nullptr;
     MS.initializeCallbacks(*F.getParent());
 
     // In the presence of unreachable blocks, we may see Phi nodes with
     // incoming nodes from such blocks. Since InstVisitor skips unreachable
     // blocks, such nodes will not have any shadow value associated with them.
     // It's easier to remove unreachable blocks than deal with missing shadow.
     removeUnreachableBlocks(F);
 
return IRB.CreateIntToPtr(OriginLong,
                               PointerType::get(IRB.getInt32Ty(), 0));
   }
 
   /// \brief Compute the shadow address for a given function argument.
   ///
   /// Shadow = ParamTLS+ArgOffset.
   Value *getShadowPtrForArgument(Value *A, IRBuilder<> &IRB,
                                  int ArgOffset) {
-    Value *Base = IRB.CreatePointerCast(MS.ParamTLS, MS.IntptrTy);
+    Value *Base = IRB.CreatePointerCast(MS.getParamTLS(IRB), MS.IntptrTy);  
     Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
     return IRB.CreateIntToPtr(Base, PointerType::get(getShadowTy(A), 0),
                               "_msarg");
   }
 
   /// \brief Compute the origin address for a given function argument.
   Value *getOriginPtrForArgument(Value *A, IRBuilder<> &IRB,
                                  int ArgOffset) {
     if (!MS.TrackOrigins) return nullptr;
-    Value *Base = IRB.CreatePointerCast(MS.ParamOriginTLS, MS.IntptrTy);
+    Value *Base = IRB.CreatePointerCast(MS.getParamOriginTLS(IRB), MS.IntptrTy);
     Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
     return IRB.CreateIntToPtr(Base, PointerType::get(MS.OriginTy, 0),
                               "_msarg_o");
   }
 
   /// \brief Compute the shadow address for a retval.
   Value *getShadowPtrForRetval(Value *A, IRBuilder<> &IRB) {
-    Value *Base = IRB.CreatePointerCast(MS.RetvalTLS, MS.IntptrTy);
+    Value *Base = IRB.CreatePointerCast(MS.getRetvalTLS(IRB), MS.IntptrTy);  
     return IRB.CreateIntToPtr(Base, PointerType::get(getShadowTy(A), 0),
                               "_msret");
   }
 
   /// \brief Compute the origin address for a retval.
   Value *getOriginPtrForRetval(IRBuilder<> &IRB) {
     // We keep a single origin for the entire retval. Might be too optimistic.
-    return MS.RetvalOriginTLS;
+    return MS.getRetvalOriginTLS(IRB);
   }
 
   /// \brief Set SV to be the shadow value for V.
   void setShadow(Value *V, Value *SV) {
     assert(!ShadowMap.count(V) && "Values may only have one shadow");
     ShadowMap[V] = PropagateShadow ? SV : getCleanShadow(V);
   }
 
for (CallSite::arg_iterator ArgIt = CS.arg_begin(), End = CS.arg_end();
         // but don't actually store shadows for them.
         if (IsFixed)
           continue;
         IRB.CreateAlignedStore(MSV.getShadow(A), Base, kShadowTLSAlignment);
       }
     }
     Constant *OverflowSize =
       ConstantInt::get(IRB.getInt64Ty(), OverflowOffset - AMD64FpEndOffset);
-    IRB.CreateStore(OverflowSize, MS.VAArgOverflowSizeTLS);
+    IRB.CreateStore(OverflowSize, MS.getVAArgOverflowSizeTLS(IRB));
   }
 
   /// \brief Compute the shadow address for a given va_arg.
   Value *getShadowPtrForVAArgument(Type *Ty, IRBuilder<> &IRB,
                                    int ArgOffset) {
-    Value *Base = IRB.CreatePointerCast(MS.VAArgTLS, MS.IntptrTy);
+    Value *Base = IRB.CreatePointerCast(MS.getVAArgTLS(IRB), MS.IntptrTy);
     Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
     return IRB.CreateIntToPtr(Base, PointerType::get(MSV.getShadowTy(Ty), 0),
                               "_msarg");
   }
 
   void visitVAStartInst(VAStartInst &I) override {
     if (F.getCallingConv() == CallingConv::X86_64_Win64)
       return;
struct VarArgAMD64Helper : public VarArgHelper {
 
   void finalizeInstrumentation() override {
     assert(!VAArgOverflowSize && !VAArgTLSCopy &&
            "finalizeInstrumentation called twice");
     if (!VAStartInstrumentationList.empty()) {
       // If there is a va_start in this function, make a backup copy of
       // va_arg_tls somewhere in the function entry block.
       IRBuilder<> IRB(F.getEntryBlock().getFirstNonPHI());
-      VAArgOverflowSize = IRB.CreateLoad(MS.VAArgOverflowSizeTLS);
+      VAArgOverflowSize = IRB.CreateLoad(MS.getVAArgOverflowSizeTLS(IRB));
       Value *CopySize =
         IRB.CreateAdd(ConstantInt::get(MS.IntptrTy, AMD64FpEndOffset),
                       VAArgOverflowSize);
       VAArgTLSCopy = IRB.CreateAlloca(Type::getInt8Ty(*MS.C), CopySize);
-      IRB.CreateMemCpy(VAArgTLSCopy, MS.VAArgTLS, CopySize, 8);
+      IRB.CreateMemCpy(VAArgTLSCopy, MS.getVAArgTLS(IRB), CopySize, 8);
     }
 
     // Instrument va_start.
     // Copy va_list shadow from the backup copy of the TLS contents.
     for (size_t i = 0, n = VAStartInstrumentationList.size(); i < n; i++) {
       CallInst *OrigInst = VAStartInstrumentationList[i];
       IRBuilder<> IRB(OrigInst->getNextNode());
       Value *VAListTag = OrigInst->getArgOperand(0);
for (CallSite::arg_iterator ArgIt = CS.arg_begin() +
       VAArgOffset += ArgSize;
       VAArgOffset = alignTo(VAArgOffset, 8);
       IRB.CreateAlignedStore(MSV.getShadow(A), Base, kShadowTLSAlignment);
     }
 
     Constant *TotalVAArgSize = ConstantInt::get(IRB.getInt64Ty(), VAArgOffset);
     // Here using VAArgOverflowSizeTLS as VAArgSizeTLS to avoid creation of
     // a new class member i.e. it is the total size of all VarArgs.
-    IRB.CreateStore(TotalVAArgSize, MS.VAArgOverflowSizeTLS);
+    IRB.CreateStore(TotalVAArgSize, MS.getVAArgOverflowSizeTLS(IRB));
   }
 
   /// \brief Compute the shadow address for a given va_arg.
   Value *getShadowPtrForVAArgument(Type *Ty, IRBuilder<> &IRB,
                                    int ArgOffset) {
-    Value *Base = IRB.CreatePointerCast(MS.VAArgTLS, MS.IntptrTy);
+    Value *Base = IRB.CreatePointerCast(MS.getVAArgTLS(IRB), MS.IntptrTy);
     Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
     return IRB.CreateIntToPtr(Base, PointerType::get(MSV.getShadowTy(Ty), 0),
                               "_msarg");
   }
 
   void visitVAStartInst(VAStartInst &I) override {
     IRBuilder<> IRB(&I);
     VAStartInstrumentationList.push_back(&I);
void visitVACopyInst(VACopyInst &I) override {
     IRB.CreateMemSet(ShadowPtr, Constant::getNullValue(IRB.getInt8Ty()),
                      /* size */8, /* alignment */8, false);
   }
 
   void finalizeInstrumentation() override {
     assert(!VAArgSize && !VAArgTLSCopy &&
            "finalizeInstrumentation called twice");
     IRBuilder<> IRB(F.getEntryBlock().getFirstNonPHI());
-    VAArgSize = IRB.CreateLoad(MS.VAArgOverflowSizeTLS);
+    VAArgSize = IRB.CreateLoad(MS.getVAArgOverflowSizeTLS(IRB));
     Value *CopySize = IRB.CreateAdd(ConstantInt::get(MS.IntptrTy, 0),
                                     VAArgSize);
 
     if (!VAStartInstrumentationList.empty()) {
       // If there is a va_start in this function, make a backup copy of
       // va_arg_tls somewhere in the function entry block.
       VAArgTLSCopy = IRB.CreateAlloca(Type::getInt8Ty(*MS.C), CopySize);
-      IRB.CreateMemCpy(VAArgTLSCopy, MS.VAArgTLS, CopySize, 8);
+      IRB.CreateMemCpy(VAArgTLSCopy, MS.getVAArgTLS(IRB), CopySize, 8);
     }
 
     // Instrument va_start.
     // Copy va_list shadow from the backup copy of the TLS contents.
     for (size_t i = 0, n = VAStartInstrumentationList.size(); i < n; i++) {
       CallInst *OrigInst = VAStartInstrumentationList[i];
       IRBuilder<> IRB(OrigInst->getNextNode());
       Value *VAListTag = OrigInst->getArgOperand(0);
for (CallSite::arg_iterator ArgIt = CS.arg_begin(), End = CS.arg_end();
       // Count Gp/Vr fixed arguments to their respective offsets, but don't
       // bother to actually store a shadow.
       if (IsFixed)
         continue;
       IRB.CreateAlignedStore(MSV.getShadow(A), Base, kShadowTLSAlignment);
     }
     Constant *OverflowSize =
       ConstantInt::get(IRB.getInt64Ty(), OverflowOffset - AArch64VAEndOffset);
-    IRB.CreateStore(OverflowSize, MS.VAArgOverflowSizeTLS);
+    IRB.CreateStore(OverflowSize, MS.getVAArgOverflowSizeTLS(IRB));
   }
 
   /// Compute the shadow address for a given va_arg.
   Value *getShadowPtrForVAArgument(Type *Ty, IRBuilder<> &IRB,
                                    int ArgOffset) {
-    Value *Base = IRB.CreatePointerCast(MS.VAArgTLS, MS.IntptrTy);
+    Value *Base = IRB.CreatePointerCast(MS.getVAArgTLS(IRB), MS.IntptrTy);
     Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
     return IRB.CreateIntToPtr(Base, PointerType::get(MSV.getShadowTy(Ty), 0),
                               "_msarg");
   }
 
   void visitVAStartInst(VAStartInst &I) override {
     IRBuilder<> IRB(&I);
     VAStartInstrumentationList.push_back(&I);
struct VarArgAArch64Helper : public VarArgHelper {
 
   void finalizeInstrumentation() override {
     assert(!VAArgOverflowSize && !VAArgTLSCopy &&
            "finalizeInstrumentation called twice");
     if (!VAStartInstrumentationList.empty()) {
       // If there is a va_start in this function, make a backup copy of
       // va_arg_tls somewhere in the function entry block.
       IRBuilder<> IRB(F.getEntryBlock().getFirstNonPHI());
-      VAArgOverflowSize = IRB.CreateLoad(MS.VAArgOverflowSizeTLS);
+      VAArgOverflowSize = IRB.CreateLoad(MS.getVAArgOverflowSizeTLS(IRB));
       Value *CopySize =
         IRB.CreateAdd(ConstantInt::get(MS.IntptrTy, AArch64VAEndOffset),
                       VAArgOverflowSize);
       VAArgTLSCopy = IRB.CreateAlloca(Type::getInt8Ty(*MS.C), CopySize);
-      IRB.CreateMemCpy(VAArgTLSCopy, MS.VAArgTLS, CopySize, 8);
+      IRB.CreateMemCpy(VAArgTLSCopy, MS.getVAArgTLS(IRB), CopySize, 8);
     }
 
     Value *GrArgSize = ConstantInt::get(MS.IntptrTy, kAArch64GrArgSize);
     Value *VrArgSize = ConstantInt::get(MS.IntptrTy, kAArch64VrArgSize);
 
     // Instrument va_start, copy va_list shadow from the backup copy of
     // the TLS contents.
     for (size_t i = 0, n = VAStartInstrumentationList.size(); i < n; i++) {
for (CallSite::arg_iterator ArgIt = CS.arg_begin(), End = CS.arg_end();
       if (IsFixed)
         VAArgBase = VAArgOffset;
     }
 
     Constant *TotalVAArgSize = ConstantInt::get(IRB.getInt64Ty(),
                                                 VAArgOffset - VAArgBase);
     // Here using VAArgOverflowSizeTLS as VAArgSizeTLS to avoid creation of
     // a new class member i.e. it is the total size of all VarArgs.
-    IRB.CreateStore(TotalVAArgSize, MS.VAArgOverflowSizeTLS);
+    IRB.CreateStore(TotalVAArgSize, MS.getVAArgOverflowSizeTLS(IRB));
   }
 
   /// \brief Compute the shadow address for a given va_arg.
   Value *getShadowPtrForVAArgument(Type *Ty, IRBuilder<> &IRB,
                                    int ArgOffset) {
-    Value *Base = IRB.CreatePointerCast(MS.VAArgTLS, MS.IntptrTy);
+    Value *Base = IRB.CreatePointerCast(MS.getVAArgTLS(IRB), MS.IntptrTy);
     Base = IRB.CreateAdd(Base, ConstantInt::get(MS.IntptrTy, ArgOffset));
     return IRB.CreateIntToPtr(Base, PointerType::get(MSV.getShadowTy(Ty), 0),
                               "_msarg");
   }
 
   void visitVAStartInst(VAStartInst &I) override {
     IRBuilder<> IRB(&I);
     VAStartInstrumentationList.push_back(&I);
void visitVACopyInst(VACopyInst &I) override {
     IRB.CreateMemSet(ShadowPtr, Constant::getNullValue(IRB.getInt8Ty()),
                      /* size */8, /* alignment */8, false);
   }
 
   void finalizeInstrumentation() override {
     assert(!VAArgSize && !VAArgTLSCopy &&
            "finalizeInstrumentation called twice");
     IRBuilder<> IRB(F.getEntryBlock().getFirstNonPHI());
-    VAArgSize = IRB.CreateLoad(MS.VAArgOverflowSizeTLS);
+    VAArgSize = IRB.CreateLoad(MS.getVAArgOverflowSizeTLS(IRB));
     Value *CopySize = IRB.CreateAdd(ConstantInt::get(MS.IntptrTy, 0),
                                     VAArgSize);
 
     if (!VAStartInstrumentationList.empty()) {
       // If there is a va_start in this function, make a backup copy of
       // va_arg_tls somewhere in the function entry block.
       VAArgTLSCopy = IRB.CreateAlloca(Type::getInt8Ty(*MS.C), CopySize);
-      IRB.CreateMemCpy(VAArgTLSCopy, MS.VAArgTLS, CopySize, 8);
+      IRB.CreateMemCpy(VAArgTLSCopy, MS.getVAArgTLS(IRB), CopySize, 8);
     }
 
     // Instrument va_start.
     // Copy va_list shadow from the backup copy of the TLS contents.
     for (size_t i = 0, n = VAStartInstrumentationList.size(); i < n; i++) {
       CallInst *OrigInst = VAStartInstrumentationList[i];
       IRBuilder<> IRB(OrigInst->getNextNode());
       Value *VAListTag = OrigInst->getArgOperand(0);