gcc/vtable-verify.c

   1 /* Copyright (C) 2013-2015 Free Software Foundation, Inc.
   2
   3 This file is part of GCC.
   4
   5 GCC is free software; you can redistribute it and/or modify it under
   6 the terms of the GNU General Public License as published by the Free
   7 Software Foundation; either version 3, or (at your option) any later
   8 version.
   9
  10 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  11 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  12 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13 for more details.
  14
  15 You should have received a copy of the GNU General Public License
  16 along with GCC; see the file COPYING3.  If not see
  17 <http://www.gnu.org/licenses/>.  */
  18
  19 /* Virtual Table Pointer Security Pass - Detect corruption of vtable pointers
  20    before using them for virtual method dispatches.  */
  21
  22 /* This file is part of the vtable security feature implementation.
  23    The vtable security feature is designed to detect when a virtual
  24    call is about to be made through an invalid vtable pointer
  25    (possibly due to data corruption or malicious attacks). The
  26    compiler finds every virtual call, and inserts a verification call
  27    before the virtual call.  The verification call takes the actual
  28    vtable pointer value in the object through which the virtual call
  29    is being made, and compares the vtable pointer against a set of all
  30    valid vtable pointers that the object could contain (this set is
  31    based on the declared type of the object).  If the pointer is in
  32    the valid set, execution is allowed to continue; otherwise the
  33    program is halted.
  34
  35   There are several pieces needed in order to make this work: 1. For
  36   every virtual class in the program (i.e. a class that contains
  37   virtual methods), we need to build the set of all possible valid
  38   vtables that an object of that class could point to.  This includes
  39   vtables for any class(es) that inherit from the class under
  40   consideration.  2. For every such data set we build up, we need a
  41   way to find and reference the data set.  This is complicated by the
  42   fact that the real vtable addresses are not known until runtime,
  43   when the program is loaded into memory, but we need to reference the
  44   sets at compile time when we are inserting verification calls into
  45   the program.  3.  We need to find every virtual call in the program,
  46   and insert the verification call (with the appropriate arguments)
  47   before the virtual call.  4. We need some runtime library pieces:
  48   the code to build up the data sets at runtime; the code to actually
  49   perform the verification using the data sets; and some code to set
  50   protections on the data sets, so they themselves do not become
  51   hacker targets.
  52
  53   To find and reference the set of valid vtable pointers for any given
  54   virtual class, we create a special global variable for each virtual
  55   class.  We refer to this as the "vtable map variable" for that
  56   class.  The vtable map variable has the type "void *", and is
  57   initialized by the compiler to NULL.  At runtime when the set of
  58   valid vtable pointers for a virtual class, e.g. class Foo, is built,
  59   the vtable map variable for class Foo is made to point to the set.
  60   During compile time, when the compiler is inserting verification
  61   calls into the program, it passes the vtable map variable for the
  62   appropriate class to the verification call, so that at runtime the
  63   verification call can find the appropriate data set.
  64
  65   The actual set of valid vtable pointers for a virtual class,
  66   e.g. class Foo, cannot be built until runtime, when the vtables get
  67   loaded into memory and their addresses are known.  But the knowledge
  68   about which vtables belong in which class' hierarchy is only known
  69   at compile time.  Therefore at compile time we collect class
  70   hierarchy and vtable information about every virtual class, and we
  71   generate calls to build up the data sets at runtime.  To build the
  72   data sets, we call one of the functions we add to the runtime
  73   library, __VLTRegisterPair.  __VLTRegisterPair takes two arguments,
  74   a vtable map variable and the address of a vtable.  If the vtable
  75   map variable is currently NULL, it creates a new data set (hash
  76   table), makes the vtable map variable point to the new data set, and
  77   inserts the vtable address into the data set.  If the vtable map
  78   variable is not NULL, it just inserts the vtable address into the
  79   data set.  In order to make sure that our data sets are built before
  80   any verification calls happen, we create a special constructor
  81   initialization function for each compilation unit, give it a very
  82   high initialization priority, and insert all of our calls to
  83   __VLTRegisterPair into our special constructor initialization
  84   function.
  85
  86   The vtable verification feature is controlled by the flag
  87   '-fvtable-verify='.  There are three flavors of this:
  88   '-fvtable-verify=std', '-fvtable-verify=preinit', and
  89   '-fvtable-verify=none'.  If the option '-fvtable-verfy=preinit' is
  90   used, then our constructor initialization function gets put into the
  91   preinit array.  This is necessary if there are data sets that need
  92   to be built very early in execution.  If the constructor
  93   initialization function gets put into the preinit array, the we also
  94   add calls to __VLTChangePermission at the beginning and end of the
  95   function.  The call at the beginning sets the permissions on the
  96   data sets and vtable map variables to read/write, and the one at the
  97   end makes them read-only.  If the '-fvtable-verify=std' option is
  98   used, the constructor initialization functions are executed at their
  99   normal time, and the __VLTChangePermission calls are handled
 100   differently (see the comments in libstdc++-v3/libsupc++/vtv_rts.cc).
 101   The option '-fvtable-verify=none' turns off vtable verification.
 102
 103   This file contains code for the tree pass that goes through all the
 104   statements in each basic block, looking for virtual calls, and
 105   inserting a call to __VLTVerifyVtablePointer (with appropriate
 106   arguments) before each one.  It also contains the hash table
 107   functions for the data structures used for collecting the class
 108   hierarchy data and building/maintaining the vtable map variable data
 109   are defined in gcc/vtable-verify.h.  These data structures are
 110   shared with the code in the C++ front end that collects the class
 111   hierarchy & vtable information and generates the vtable map
 112   variables (see cp/vtable-class-hierarchy.c).  This tree pass should
 113   run just before the gimple is converted to RTL.
 114
 115   Some implementation details for this pass:
 116
 117   To find all of the virtual calls, we iterate through all the
 118   gimple statements in each basic block, looking for any call
 119   statement with the code "OBJ_TYPE_REF".  Once we have found the
 120   virtual call, we need to find the vtable pointer through which the
 121   call is being made, and the type of the object containing the
 122   pointer (to find the appropriate vtable map variable).  We then use
 123   these to build a call to __VLTVerifyVtablePointer, passing the
 124   vtable map variable, and the vtable pointer.  We insert the
 125   verification call just after the gimple statement that gets the
 126   vtable pointer out of the object, and we update the next
 127   statement to depend on the result returned from
 128   __VLTVerifyVtablePointer (the vtable pointer value), to ensure
 129   subsequent compiler phases don't remove or reorder the call (it's no
 130   good to have the verification occur after the virtual call, for
 131   example).  To find the vtable pointer being used (and the type of
 132   the object) we search backwards through the def_stmts chain from the
 133   virtual call (see verify_bb_vtables for more details).  */
 134
 135 #include "config.h"
 136 #include "system.h"
 137 #include "coretypes.h"
 138 #include "alias.h"
 139 #include "backend.h"
 140 #include "tree.h"
 141 #include "gimple.h"
 142 #include "hard-reg-set.h"
 143 #include "ssa.h"
 144 #include "options.h"
 145 #include "fold-const.h"
 146 #include "internal-fn.h"
 147 #include "gimple-iterator.h"
 148 #include "tree-pass.h"
 149 #include "cfgloop.h"
 150
 151 #include "vtable-verify.h"
 152
 153 unsigned num_vtable_map_nodes = 0;
 154 int total_num_virtual_calls = 0;
 155 int total_num_verified_vcalls = 0;
 156
 157 extern GTY(()) tree verify_vtbl_ptr_fndecl;
 158 tree verify_vtbl_ptr_fndecl = NULL_TREE;
 159
 160 /* Keep track of whether or not any virtual call were verified.  */
 161 static bool any_verification_calls_generated = false;
 162
 163 unsigned int vtable_verify_main (void);
 164
 165
 166 /* The following few functions are for the vtbl pointer hash table
 167    in the 'registered' field of the struct vtable_map_node.  The hash
 168    table keeps track of which vtable pointers have been used in
 169    calls to __VLTRegisterPair with that particular vtable map variable.  */
 170
 171 /* This function checks to see if a particular VTABLE_DECL and OFFSET are
 172    already in the 'registered' hash table for NODE.  */
 173
 174 bool
 175 vtbl_map_node_registration_find (struct vtbl_map_node *node,
 176                                  tree vtable_decl,
 177                                  unsigned offset)
 178 {
 179   struct vtable_registration key;
 180   struct vtable_registration **slot;
 181
 182   gcc_assert (node && node->registered);
 183
 184   key.vtable_decl = vtable_decl;
 185   slot = node->registered->find_slot (&key, NO_INSERT);
 186
 187   if (slot && (*slot))
 188     {
 189       unsigned i;
 190       for (i = 0; i < ((*slot)->offsets).length (); ++i)
 191         if ((*slot)->offsets[i] == offset)
 192           return true;
 193     }
 194
 195   return false;
 196 }
 197
 198 /* This function inserts VTABLE_DECL and OFFSET into the 'registered'
 199    hash table for NODE.  It returns a boolean indicating whether or not
 200    it actually inserted anything.  */
 201
 202 bool
 203 vtbl_map_node_registration_insert (struct vtbl_map_node *node,
 204                                    tree vtable_decl,
 205                                    unsigned offset)
 206 {
 207   struct vtable_registration key;
 208   struct vtable_registration **slot;
 209   bool inserted_something = false;
 210
 211   if (!node || !node->registered)
 212     return false;
 213
 214   key.vtable_decl = vtable_decl;
 215   slot = node->registered->find_slot (&key, INSERT);
 216
 217   if (! *slot)
 218     {
 219       struct vtable_registration *node;
 220       node = XNEW (struct vtable_registration);
 221       node->vtable_decl = vtable_decl;
 222
 223       (node->offsets).create (10);
 224       (node->offsets).safe_push (offset);
 225       *slot = node;
 226       inserted_something = true;
 227     }
 228   else
 229     {
 230       /* We found the vtable_decl slot; we need to see if it already
 231          contains the offset.  If not, we need to add the offset.  */
 232       unsigned i;
 233       bool found = false;
 234       for (i = 0; i < ((*slot)->offsets).length () && !found; ++i)
 235         if ((*slot)->offsets[i] == offset)
 236           found = true;
 237
 238       if (!found)
 239         {
 240           ((*slot)->offsets).safe_push (offset);
 241           inserted_something = true;
 242         }
 243      }
 244   return inserted_something;
 245 }
 246
 247 /* Hashtable functions for vtable_registration hashtables.  */
 248
 249 inline hashval_t
 250 registration_hasher::hash (const vtable_registration *p)
 251 {
 252   const struct vtable_registration *n = (const struct vtable_registration *) p;
 253   return (hashval_t) (DECL_UID (n->vtable_decl));
 254 }
 255
 256 inline bool
 257 registration_hasher::equal (const vtable_registration *p1,
 258                             const vtable_registration *p2)
 259 {
 260   const struct vtable_registration *n1 =
 261                                     (const struct vtable_registration *) p1;
 262   const struct vtable_registration *n2 =
 263                                     (const struct vtable_registration *) p2;
 264   return (DECL_UID (n1->vtable_decl) == DECL_UID (n2->vtable_decl));
 265 }
 266
 267 /* End of hashtable functions for "registered" hashtables.  */
 268
 269
 270
 271 /* Hashtable definition and functions for vtbl_map_hash.  */
 272
 273 struct vtbl_map_hasher : nofree_ptr_hash <struct vtbl_map_node>
 274 {
 275   static inline hashval_t hash (const vtbl_map_node *);
 276   static inline bool equal (const vtbl_map_node *, const vtbl_map_node *);
 277 };
 278
 279 /* Returns a hash code for P.  */
 280
 281 inline hashval_t
 282 vtbl_map_hasher::hash (const vtbl_map_node *p)
 283 {
 284   const struct vtbl_map_node n = *((const struct vtbl_map_node *) p);
 285   return (hashval_t) IDENTIFIER_HASH_VALUE (n.class_name);
 286 }
 287
 288 /* Returns nonzero if P1 and P2 are equal.  */
 289
 290 inline bool
 291 vtbl_map_hasher::equal (const vtbl_map_node *p1, const vtbl_map_node *p2)
 292 {
 293   const struct vtbl_map_node n1 = *((const struct vtbl_map_node *) p1);
 294   const struct vtbl_map_node n2 = *((const struct vtbl_map_node *) p2);
 295   return (IDENTIFIER_HASH_VALUE (n1.class_name) ==
 296           IDENTIFIER_HASH_VALUE (n2.class_name));
 297 }
 298
 299 /* Here are the two structures into which we insert vtable map nodes.
 300    We use two data structures because of the vastly different ways we need
 301    to find the nodes for various tasks (see comments in vtable-verify.h
 302    for more details.  */
 303
 304 typedef hash_table<vtbl_map_hasher> vtbl_map_table_type;
 305 typedef vtbl_map_table_type::iterator vtbl_map_iterator_type;
 306
 307 /* Vtable map variable nodes stored in a hash table.  */
 308 static vtbl_map_table_type *vtbl_map_hash;
 309
 310 /* Vtable map variable nodes stored in a vector.  */
 311 vec<struct vtbl_map_node *> vtbl_map_nodes_vec;
 312
 313 /* Return vtbl_map node for CLASS_NAME  without creating a new one.  */
 314
 315 struct vtbl_map_node *
 316 vtbl_map_get_node (tree class_type)
 317 {
 318   struct vtbl_map_node key;
 319   struct vtbl_map_node **slot;
 320
 321   tree class_type_decl;
 322   tree class_name;
 323   unsigned int type_quals;
 324
 325   if (!vtbl_map_hash)
 326     return NULL;
 327
 328   gcc_assert (TREE_CODE (class_type) == RECORD_TYPE);
 329
 330
 331   /* Find the TYPE_DECL for the class.  */
 332   class_type_decl = TYPE_NAME (class_type);
 333
 334   /* Verify that there aren't any qualifiers on the type.  */
 335   type_quals = TYPE_QUALS (TREE_TYPE (class_type_decl));
 336   gcc_assert (type_quals == TYPE_UNQUALIFIED);
 337
 338   /* Get the mangled name for the unqualified type.  */
 339   gcc_assert (HAS_DECL_ASSEMBLER_NAME_P (class_type_decl));
 340   class_name = DECL_ASSEMBLER_NAME (class_type_decl);
 341
 342   key.class_name = class_name;
 343   slot = (struct vtbl_map_node **) vtbl_map_hash->find_slot (&key, NO_INSERT);
 344   if (!slot)
 345     return NULL;
 346   return *slot;
 347 }
 348
 349 /* Return vtbl_map node assigned to BASE_CLASS_TYPE.  Create new one
 350    when needed.  */
 351
 352 struct vtbl_map_node *
 353 find_or_create_vtbl_map_node (tree base_class_type)
 354 {
 355   struct vtbl_map_node key;
 356   struct vtbl_map_node *node;
 357   struct vtbl_map_node **slot;
 358   tree class_type_decl;
 359   unsigned int type_quals;
 360
 361   if (!vtbl_map_hash)
 362     vtbl_map_hash = new vtbl_map_table_type (10);
 363
 364   /* Find the TYPE_DECL for the class.  */
 365   class_type_decl = TYPE_NAME (base_class_type);
 366
 367   /* Verify that there aren't any type qualifiers on type.  */
 368   type_quals = TYPE_QUALS (TREE_TYPE (class_type_decl));
 369   gcc_assert (type_quals == TYPE_UNQUALIFIED);
 370
 371   gcc_assert (HAS_DECL_ASSEMBLER_NAME_P (class_type_decl));
 372   key.class_name = DECL_ASSEMBLER_NAME (class_type_decl);
 373   slot = (struct vtbl_map_node **) vtbl_map_hash->find_slot (&key, INSERT);
 374
 375   if (*slot)
 376     return *slot;
 377
 378   node = XNEW (struct vtbl_map_node);
 379   node->vtbl_map_decl = NULL_TREE;
 380   node->class_name = key.class_name;
 381   node->uid = num_vtable_map_nodes++;
 382
 383   node->class_info = XNEW (struct vtv_graph_node);
 384   node->class_info->class_type = base_class_type;
 385   node->class_info->class_uid = node->uid;
 386   node->class_info->num_processed_children = 0;
 387
 388   (node->class_info->parents).create (4);
 389   (node->class_info->children).create (4);
 390
 391   node->registered = new register_table_type (16);
 392
 393   node->is_used = false;
 394
 395   vtbl_map_nodes_vec.safe_push (node);
 396   gcc_assert (vtbl_map_nodes_vec[node->uid] == node);
 397
 398   *slot = node;
 399   return node;
 400 }
 401
 402 /* End of hashtable functions for vtable_map variables hash table.   */
 403
 404 /* Given a gimple STMT, this function checks to see if the statement
 405    is an assignment, the rhs of which is getting the vtable pointer
 406    value out of an object.  (i.e. it's the value we need to verify
 407    because its the vtable pointer that will be used for a virtual
 408    call).  */
 409
 410 static bool
 411 is_vtable_assignment_stmt (gimple stmt)
 412 {
 413
 414   if (gimple_code (stmt) != GIMPLE_ASSIGN)
 415     return false;
 416   else
 417     {
 418       tree lhs = gimple_assign_lhs (stmt);
 419       tree rhs = gimple_assign_rhs1 (stmt);
 420
 421       if (TREE_CODE (lhs) != SSA_NAME)
 422         return false;
 423
 424       if (TREE_CODE (rhs) != COMPONENT_REF)
 425         return false;
 426
 427       if (! (TREE_OPERAND (rhs, 1))
 428           || (TREE_CODE (TREE_OPERAND (rhs, 1)) != FIELD_DECL))
 429         return false;
 430
 431       if (! DECL_VIRTUAL_P (TREE_OPERAND (rhs, 1)))
 432         return false;
 433     }
 434
 435     return true;
 436 }
 437
 438 /* This function attempts to recover the declared class of an object
 439    that is used in making a virtual call.  We try to get the type from
 440    the type cast in the gimple assignment statement that extracts the
 441    vtable pointer from the object (DEF_STMT).  The gimple statement
 442    usually looks something like this:
 443
 444    D.2201_4 = MEM[(struct Event *)this_1(D)]._vptr.Event    */
 445
 446 static tree
 447 extract_object_class_type (tree rhs)
 448 {
 449   tree result = NULL_TREE;
 450
 451   /* Try to find and extract the type cast from that stmt.  */
 452   if (TREE_CODE (rhs) == COMPONENT_REF)
 453     {
 454       tree op0 = TREE_OPERAND (rhs, 0);
 455       tree op1 = TREE_OPERAND (rhs, 1);
 456
 457       if (TREE_CODE (op1) == FIELD_DECL
 458           && DECL_VIRTUAL_P (op1))
 459         {
 460           if (TREE_CODE (op0) == COMPONENT_REF
 461               && TREE_CODE (TREE_OPERAND (op0, 0)) == MEM_REF
 462               && TREE_CODE (TREE_TYPE (TREE_OPERAND (op0, 0)))== RECORD_TYPE)
 463             result = TREE_TYPE (TREE_OPERAND (op0, 0));
 464           else
 465             result = TREE_TYPE (op0);
 466         }
 467       else if (TREE_CODE (op0) == COMPONENT_REF)
 468         {
 469           result = extract_object_class_type (op0);
 470           if (result == NULL_TREE
 471               && TREE_CODE (op1) == COMPONENT_REF)
 472             result = extract_object_class_type (op1);
 473         }
 474     }
 475
 476   return result;
 477 }
 478
 479 /* This function traces forward through the def-use chain of an SSA
 480    variable to see if it ever gets used in a virtual function call.  It
 481    returns a boolean indicating whether or not it found a virtual call in
 482    the use chain.  */
 483
 484 static bool
 485 var_is_used_for_virtual_call_p (tree lhs, int *mem_ref_depth)
 486 {
 487   imm_use_iterator imm_iter;
 488   bool found_vcall = false;
 489   use_operand_p use_p;
 490
 491   if (TREE_CODE (lhs) != SSA_NAME)
 492     return false;
 493
 494   if (*mem_ref_depth > 2)
 495     return false;
 496
 497   /* Iterate through the immediate uses of the current variable.  If
 498      it's a virtual function call, we're done.  Otherwise, if there's
 499      an LHS for the use stmt, add the ssa var to the work list
 500      (assuming it's not already in the list and is not a variable
 501      we've already examined.  */
 502
 503   FOR_EACH_IMM_USE_FAST (use_p, imm_iter, lhs)
 504     {
 505       gimple stmt2 = USE_STMT (use_p);
 506
 507       if (is_gimple_call (stmt2))
 508         {
 509           tree fncall = gimple_call_fn (stmt2);
 510           if (fncall && TREE_CODE (fncall) == OBJ_TYPE_REF)
 511             found_vcall = true;
 512           else
 513             return false;
 514         }
 515       else if (gimple_code (stmt2) == GIMPLE_PHI)
 516         {
 517           found_vcall = var_is_used_for_virtual_call_p
 518                                                     (gimple_phi_result (stmt2),
 519                                                      mem_ref_depth);
 520         }
 521       else if (is_gimple_assign (stmt2))
 522         {
 523           tree rhs = gimple_assign_rhs1 (stmt2);
 524           if (TREE_CODE (rhs) == ADDR_EXPR
 525               || TREE_CODE (rhs) == MEM_REF)
 526             *mem_ref_depth = *mem_ref_depth + 1;
 527
 528           if (TREE_CODE (rhs) == COMPONENT_REF)
 529             {
 530               while (TREE_CODE (TREE_OPERAND (rhs, 0)) == COMPONENT_REF)
 531                 rhs = TREE_OPERAND (rhs, 0);
 532
 533               if (TREE_CODE (TREE_OPERAND (rhs, 0)) == ADDR_EXPR
 534                   || TREE_CODE (TREE_OPERAND (rhs, 0)) == MEM_REF)
 535                 *mem_ref_depth = *mem_ref_depth + 1;
 536             }
 537
 538           if (*mem_ref_depth < 3)
 539             found_vcall = var_is_used_for_virtual_call_p
 540                                                     (gimple_assign_lhs (stmt2),
 541                                                      mem_ref_depth);
 542         }
 543
 544       else
 545         break;
 546
 547       if (found_vcall)
 548         return true;
 549     }
 550
 551   return false;
 552 }
 553
 554 /* Search through all the statements in a basic block (BB), searching
 555    for virtual method calls.  For each virtual method dispatch, find
 556    the vptr value used, and the statically declared type of the
 557    object; retrieve the vtable map variable for the type of the
 558    object; generate a call to __VLTVerifyVtablePointer; and insert the
 559    generated call into the basic block, after the point where the vptr
 560    value is gotten out of the object and before the virtual method
 561    dispatch. Make the virtual method dispatch depend on the return
 562    value from the verification call, so that subsequent optimizations
 563    cannot reorder the two calls.  */
 564
 565 static void
 566 verify_bb_vtables (basic_block bb)
 567 {
 568   gimple_seq stmts;
 569   gimple stmt = NULL;
 570   gimple_stmt_iterator gsi_vtbl_assign;
 571   gimple_stmt_iterator gsi_virtual_call;
 572
 573   stmts = bb_seq (bb);
 574   gsi_virtual_call = gsi_start (stmts);
 575   for (; !gsi_end_p (gsi_virtual_call); gsi_next (&gsi_virtual_call))
 576     {
 577       stmt = gsi_stmt (gsi_virtual_call);
 578
 579       /* Count virtual calls.  */
 580       if (is_gimple_call (stmt))
 581         {
 582           tree fncall = gimple_call_fn (stmt);
 583           if (fncall && TREE_CODE (fncall) == OBJ_TYPE_REF)
 584             total_num_virtual_calls++;
 585         }
 586
 587       if (is_vtable_assignment_stmt (stmt))
 588         {
 589           tree lhs = gimple_assign_lhs (stmt);
 590           tree vtbl_var_decl = NULL_TREE;
 591           struct vtbl_map_node *vtable_map_node;
 592           tree vtbl_decl = NULL_TREE;
 593           gcall *call_stmt;
 594           const char *vtable_name = "<unknown>";
 595           tree tmp0;
 596           bool found;
 597           int mem_ref_depth = 0;
 598
 599           /* Make sure this vptr field access is for a virtual call.  */
 600           if (!var_is_used_for_virtual_call_p (lhs, &mem_ref_depth))
 601             continue;
 602
 603           /* Now we have found the virtual method dispatch and
 604              the preceding access of the _vptr.* field... Next
 605              we need to find the statically declared type of
 606              the object, so we can find and use the right
 607              vtable map variable in the verification call.  */
 608           tree class_type = extract_object_class_type
 609                                                    (gimple_assign_rhs1 (stmt));
 610
 611           gsi_vtbl_assign = gsi_for_stmt (stmt);
 612
 613           if (class_type
 614               && (TREE_CODE (class_type) == RECORD_TYPE)
 615               && TYPE_BINFO (class_type))
 616             {
 617               /* Get the vtable VAR_DECL for the type.  */
 618               vtbl_var_decl = BINFO_VTABLE (TYPE_BINFO (class_type));
 619
 620               if (TREE_CODE (vtbl_var_decl) == POINTER_PLUS_EXPR)
 621                 vtbl_var_decl = TREE_OPERAND (TREE_OPERAND (vtbl_var_decl, 0),
 622                                               0);
 623
 624               gcc_assert (vtbl_var_decl);
 625
 626               vtbl_decl = vtbl_var_decl;
 627               vtable_map_node = vtbl_map_get_node
 628                                                (TYPE_MAIN_VARIANT (class_type));
 629
 630               gcc_assert (verify_vtbl_ptr_fndecl);
 631
 632               /* Given the vtable pointer for the base class of the
 633                  object, build the call to __VLTVerifyVtablePointer to
 634                  verify that the object's vtable pointer (contained in
 635                  lhs) is in the set of valid vtable pointers for the
 636                  base class.  */
 637
 638               if (vtable_map_node && vtable_map_node->vtbl_map_decl)
 639                 {
 640                   vtable_map_node->is_used = true;
 641                   vtbl_var_decl = vtable_map_node->vtbl_map_decl;
 642
 643                   if (TREE_CODE (vtbl_decl) == VAR_DECL)
 644                     vtable_name = IDENTIFIER_POINTER (DECL_NAME (vtbl_decl));
 645
 646                   /* Call different routines if we are interested in
 647                      trace information to debug problems.  */
 648                   if (flag_vtv_debug)
 649                     {
 650                       int len1 = IDENTIFIER_LENGTH
 651                                                  (DECL_NAME (vtbl_var_decl));
 652                       int len2 = strlen (vtable_name);
 653
 654                       call_stmt = gimple_build_call
 655                                      (verify_vtbl_ptr_fndecl, 4,
 656                                       build1 (ADDR_EXPR,
 657                                                 TYPE_POINTER_TO
 658                                                   (TREE_TYPE (vtbl_var_decl)),
 659                                               vtbl_var_decl),
 660                                       lhs,
 661                                       build_string_literal
 662                                                   (len1 + 1,
 663                                                    IDENTIFIER_POINTER
 664                                                        (DECL_NAME
 665                                                             (vtbl_var_decl))),
 666                                       build_string_literal (len2 + 1,
 667                                                             vtable_name));
 668                     }
 669                   else
 670                     call_stmt = gimple_build_call
 671                                      (verify_vtbl_ptr_fndecl, 2,
 672                                       build1 (ADDR_EXPR,
 673                                                 TYPE_POINTER_TO
 674                                                   (TREE_TYPE (vtbl_var_decl)),
 675                                                  vtbl_var_decl),
 676                                       lhs);
 677
 678
 679                   /* Create a new SSA_NAME var to hold the call's
 680                      return value, and make the call_stmt use the
 681                      variable for that purpose.  */
 682                   tmp0 = make_temp_ssa_name (TREE_TYPE (lhs), NULL, "VTV");
 683                   gimple_call_set_lhs (call_stmt, tmp0);
 684                   update_stmt (call_stmt);
 685
 686                   /* Replace all uses of lhs with tmp0. */
 687                   found = false;
 688                   imm_use_iterator iterator;
 689                   gimple use_stmt;
 690                   FOR_EACH_IMM_USE_STMT (use_stmt, iterator, lhs)
 691                     {
 692                       use_operand_p use_p;
 693                       if (use_stmt == call_stmt)
 694                         continue;
 695                       FOR_EACH_IMM_USE_ON_STMT (use_p, iterator)
 696                         SET_USE (use_p, tmp0);
 697                       update_stmt (use_stmt);
 698                       found = true;
 699                     }
 700
 701                   gcc_assert (found);
 702
 703                   /* Insert the new verification call just after the
 704                      statement that gets the vtable pointer out of the
 705                      object.  */
 706                   gcc_assert (gsi_stmt (gsi_vtbl_assign) == stmt);
 707                   gsi_insert_after (&gsi_vtbl_assign, call_stmt,
 708                                     GSI_NEW_STMT);
 709
 710                   any_verification_calls_generated = true;
 711                   total_num_verified_vcalls++;
 712                 }
 713             }
 714         }
 715     }
 716 }
 717
 718 /* Definition of this optimization pass.  */
 719
 720 namespace {
 721
 722 const pass_data pass_data_vtable_verify =
 723 {
 724   GIMPLE_PASS, /* type */
 725   "vtable-verify", /* name */
 726   OPTGROUP_NONE, /* optinfo_flags */
 727   TV_VTABLE_VERIFICATION, /* tv_id */
 728   ( PROP_cfg | PROP_ssa ), /* properties_required */
 729   0, /* properties_provided */
 730   0, /* properties_destroyed */
 731   0, /* todo_flags_start */
 732   TODO_update_ssa, /* todo_flags_finish */
 733 };
 734
 735 class pass_vtable_verify : public gimple_opt_pass
 736 {
 737 public:
 738   pass_vtable_verify (gcc::context *ctxt)
 739     : gimple_opt_pass (pass_data_vtable_verify, ctxt)
 740   {}
 741
 742   /* opt_pass methods: */
 743   virtual bool gate (function *) { return (flag_vtable_verify); }
 744   virtual unsigned int execute (function *);
 745
 746 }; // class pass_vtable_verify
 747
 748 /* Loop through all the basic blocks in the current function, passing them to
 749    verify_bb_vtables, which searches for virtual calls, and inserts
 750    calls to __VLTVerifyVtablePointer.  */
 751
 752 unsigned int
 753 pass_vtable_verify::execute (function *fun)
 754 {
 755   unsigned int ret = 1;
 756   basic_block bb;
 757
 758   FOR_ALL_BB_FN (bb, fun)
 759       verify_bb_vtables (bb);
 760
 761   return ret;
 762 }
 763
 764 } // anon namespace
 765
 766 gimple_opt_pass *
 767 make_pass_vtable_verify (gcc::context *ctxt)
 768 {
 769   return new pass_vtable_verify (ctxt);
 770 }
 771
 772 #include "gt-vtable-verify.h"