1 /* Copyright (C) 2012-2015 Free Software Foundation, Inc.
3 This file is part of GCC.
5 GCC is free software; you can redistribute it and/or modify it
6 under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 3, or (at your option)
10 GCC is distributed in the hope that it will be useful, but
11 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with GCC; see the file COPYING3. If not see
17 <http://www.gnu.org/licenses/>. */
19 /* Virtual Table Pointer Security Pass - Detect corruption of vtable pointers
20 before using them for virtual method dispatches. */
22 /* This file is part of the vtable security feature implementation.
23 The vtable security feature is designed to detect when a virtual
24 call is about to be made through an invalid vtable pointer
25 (possibly due to data corruption or malicious attacks). The
26 compiler finds every virtual call, and inserts a verification call
27 before the virtual call. The verification call takes the actual
28 vtable pointer value in the object through which the virtual call
29 is being made, and compares the vtable pointer against a set of all
30 valid vtable pointers that the object could contain (this set is
31 based on the declared type of the object). If the pointer is in
32 the valid set, execution is allowed to continue; otherwise the
35 There are several pieces needed in order to make this work: 1. For
36 every virtual class in the program (i.e. a class that contains
37 virtual methods), we need to build the set of all possible valid
38 vtables that an object of that class could point to. This includes
39 vtables for any class(es) that inherit from the class under
40 consideration. 2. For every such data set we build up, we need a
41 way to find and reference the data set. This is complicated by the
42 fact that the real vtable addresses are not known until runtime,
43 when the program is loaded into memory, but we need to reference the
44 sets at compile time when we are inserting verification calls into
45 the program. 3. We need to find every virtual call in the program,
46 and insert the verification call (with the appropriate arguments)
47 before the virtual call. 4. We need some runtime library pieces:
48 the code to build up the data sets at runtime; the code to actually
49 perform the verification using the data sets; and some code to set
50 protections on the data sets, so they themselves do not become
53 To find and reference the set of valid vtable pointers for any given
54 virtual class, we create a special global varible for each virtual
55 class. We refer to this as the "vtable map variable" for that
56 class. The vtable map variable has the type "void *", and is
57 initialized by the compiler to NULL. At runtime when the set of
58 valid vtable pointers for a virtual class, e.g. class Foo, is built,
59 the vtable map variable for class Foo is made to point to the set.
60 During compile time, when the compiler is inserting verification
61 calls into the program, it passes the vtable map variable for the
62 appropriate class to the verification call, so that at runtime the
63 verification call can find the appropriate data set.
65 The actual set of valid vtable pointers for a virtual class,
66 e.g. class Foo, cannot be built until runtime, when the vtables get
67 loaded into memory and their addresses are known. But the knowledge
68 about which vtables belong in which class' hierarchy is only known
69 at compile time. Therefore at compile time we collect class
70 hierarchy and vtable information about every virtual class, and we
71 generate calls to build up the data sets at runtime. To build the
72 data sets, we call one of the functions we add to the runtime
73 library, __VLTRegisterPair. __VLTRegisterPair takes two arguments,
74 a vtable map variable and the address of a vtable. If the vtable
75 map variable is currently NULL, it creates a new data set (hash
76 table), makes the vtable map variable point to the new data set, and
77 inserts the vtable address into the data set. If the vtable map
78 variable is not NULL, it just inserts the vtable address into the
79 data set. In order to make sure that our data sets are built before
80 any verification calls happen, we create a special constructor
81 initialization function for each compilation unit, give it a very
82 high initialization priority, and insert all of our calls to
83 __VLTRegisterPair into our special constructor initialization
86 The vtable verification feature is controlled by the flag
87 '-fvtable-verify='. There are three flavors of this:
88 '-fvtable-verify=std', '-fvtable-verify=preinit', and
89 '-fvtable-verify=none'. If the option '-fvtable-verfy=preinit' is
90 used, then our constructor initialization function gets put into the
91 preinit array. This is necessary if there are data sets that need
92 to be built very early in execution. If the constructor
93 initialization function gets put into the preinit array, the we also
94 add calls to __VLTChangePermission at the beginning and end of the
95 function. The call at the beginning sets the permissions on the
96 data sets and vtable map variables to read/write, and the one at the
97 end makes them read-only. If the '-fvtable-verify=std' option is
98 used, the constructor initialization functions are executed at their
99 normal time, and the __VLTChangePermission calls are handled
100 differently (see the comments in libstdc++-v3/libsupc++/vtv_rts.cc).
101 The option '-fvtable-verify=none' turns off vtable verification.
103 This file contains code to find and record the class hierarchies for
104 the virtual classes in a program, and all the vtables associated
105 with each such class; to generate the vtable map variables; and to
106 generate the constructor initialization function (with the calls to
107 __VLTRegisterPair, and __VLTChangePermission). The main data
108 structures used for collecting the class hierarchy data and
109 building/maintaining the vtable map variable data are defined in
110 gcc/vtable-verify.h, because they are used both here and in
111 gcc/vtable-verify.c. */
115 #include "coretypes.h"
119 #include "hard-reg-set.h"
120 #include "function.h"
122 #include "tree-iterator.h"
123 #include "vtable-verify.h"
124 #include "gimplify.h"
125 #include "stringpool.h"
126 #include "stor-layout.h"
128 static int num_calls_to_regset
= 0;
129 static int num_calls_to_regpair
= 0;
130 static int current_set_size
;
132 /* Mark these specially since they need to be stored in precompiled
134 static GTY (()) vec
<tree
, va_gc
> *vlt_saved_class_info
;
135 static GTY (()) tree vlt_register_pairs_fndecl
= NULL_TREE
;
136 static GTY (()) tree vlt_register_set_fndecl
= NULL_TREE
;
139 struct vtv_graph_node
*node
;
140 struct work_node
*next
;
143 struct vtbl_map_node
*vtable_find_or_create_map_decl (tree
);
145 /* As part of vtable verification the compiler generates and inserts
146 calls to __VLTVerifyVtablePointer, which is in libstdc++. This
147 function builds and initializes the function decl that is used
148 in generating those function calls.
150 In addition to __VLTVerifyVtablePointer there is also
151 __VLTVerifyVtablePointerDebug which can be used in place of
152 __VLTVerifyVtablePointer, and which takes extra parameters and
153 outputs extra information, to help debug problems. The debug
154 version of this function is generated and used if flag_vtv_debug is
157 The signatures for these functions are:
159 void * __VLTVerifyVtablePointer (void **, void*);
160 void * __VLTVerifyVtablePointerDebug (void**, void *, char *, char *);
164 vtv_build_vtable_verify_fndecl (void)
166 tree func_type
= NULL_TREE
;
168 if (verify_vtbl_ptr_fndecl
!= NULL_TREE
169 && TREE_CODE (verify_vtbl_ptr_fndecl
) != ERROR_MARK
)
174 func_type
= build_function_type_list (const_ptr_type_node
,
175 build_pointer_type (ptr_type_node
),
177 const_string_type_node
,
178 const_string_type_node
,
180 verify_vtbl_ptr_fndecl
=
181 build_lang_decl (FUNCTION_DECL
,
182 get_identifier ("__VLTVerifyVtablePointerDebug"),
187 func_type
= build_function_type_list (const_ptr_type_node
,
188 build_pointer_type (ptr_type_node
),
191 verify_vtbl_ptr_fndecl
=
192 build_lang_decl (FUNCTION_DECL
,
193 get_identifier ("__VLTVerifyVtablePointer"),
197 TREE_NOTHROW (verify_vtbl_ptr_fndecl
) = 1;
198 DECL_ATTRIBUTES (verify_vtbl_ptr_fndecl
)
199 = tree_cons (get_identifier ("leaf"), NULL
,
200 DECL_ATTRIBUTES (verify_vtbl_ptr_fndecl
));
201 DECL_PURE_P (verify_vtbl_ptr_fndecl
) = 1;
202 TREE_PUBLIC (verify_vtbl_ptr_fndecl
) = 1;
203 DECL_PRESERVE_P (verify_vtbl_ptr_fndecl
) = 1;
206 /* As part of vtable verification the compiler generates and inserts
207 calls to __VLTRegisterSet and __VLTRegisterPair, which are in
208 libsupc++. This function builds and initializes the function decls
209 that are used in generating those function calls.
211 The signatures for these functions are:
213 void __VLTRegisterSetDebug (void **, const void *, std::size_t,
216 void __VLTRegisterSet (void **, const void *, std::size_t,
219 void __VLTRegisterPairDebug (void **, const void *, size_t,
220 const void *, const char *, const char *);
222 void __VLTRegisterPair (void **, const void *, size_t, const void *);
226 init_functions (void)
228 tree register_set_type
;
229 tree register_pairs_type
;
231 if (vlt_register_set_fndecl
!= NULL_TREE
)
234 gcc_assert (vlt_register_pairs_fndecl
== NULL_TREE
);
235 gcc_assert (vlt_register_set_fndecl
== NULL_TREE
);
237 /* Build function decl for __VLTRegisterSet*. */
239 register_set_type
= build_function_type_list
241 build_pointer_type (ptr_type_node
),
245 build_pointer_type (ptr_type_node
),
249 vlt_register_set_fndecl
= build_lang_decl
251 get_identifier ("__VLTRegisterSetDebug"),
254 vlt_register_set_fndecl
= build_lang_decl
256 get_identifier ("__VLTRegisterSet"),
260 TREE_NOTHROW (vlt_register_set_fndecl
) = 1;
261 DECL_ATTRIBUTES (vlt_register_set_fndecl
) =
262 tree_cons (get_identifier ("leaf"), NULL
,
263 DECL_ATTRIBUTES (vlt_register_set_fndecl
));
264 DECL_EXTERNAL(vlt_register_set_fndecl
) = 1;
265 TREE_PUBLIC (vlt_register_set_fndecl
) = 1;
266 DECL_PRESERVE_P (vlt_register_set_fndecl
) = 1;
267 SET_DECL_LANGUAGE (vlt_register_set_fndecl
, lang_cplusplus
);
269 /* Build function decl for __VLTRegisterPair*. */
273 register_pairs_type
= build_function_type_list (void_type_node
,
279 const_string_type_node
,
280 const_string_type_node
,
283 vlt_register_pairs_fndecl
= build_lang_decl
285 get_identifier ("__VLTRegisterPairDebug"),
286 register_pairs_type
);
290 register_pairs_type
= build_function_type_list (void_type_node
,
298 vlt_register_pairs_fndecl
= build_lang_decl
300 get_identifier ("__VLTRegisterPair"),
301 register_pairs_type
);
304 TREE_NOTHROW (vlt_register_pairs_fndecl
) = 1;
305 DECL_ATTRIBUTES (vlt_register_pairs_fndecl
) =
306 tree_cons (get_identifier ("leaf"), NULL
,
307 DECL_ATTRIBUTES (vlt_register_pairs_fndecl
));
308 DECL_EXTERNAL(vlt_register_pairs_fndecl
) = 1;
309 TREE_PUBLIC (vlt_register_pairs_fndecl
) = 1;
310 DECL_PRESERVE_P (vlt_register_pairs_fndecl
) = 1;
311 SET_DECL_LANGUAGE (vlt_register_pairs_fndecl
, lang_cplusplus
);
315 /* This is a helper function for
316 vtv_compute_class_hierarchy_transitive_closure. It adds a
317 vtv_graph_node to the WORKLIST, which is a linked list of
318 seen-but-not-yet-processed nodes. INSERTED is a bitmap, one bit
319 per node, to help make sure that we don't insert a node into the
320 worklist more than once. Each node represents a class somewhere in
321 our class hierarchy information. Every node in the graph gets added
322 to the worklist exactly once and removed from the worklist exactly
323 once (when all of its children have been processed). */
326 add_to_worklist (struct work_node
**worklist
, struct vtv_graph_node
*node
,
329 struct work_node
*new_work_node
;
331 if (bitmap_bit_p (inserted
, node
->class_uid
))
334 new_work_node
= XNEW (struct work_node
);
335 new_work_node
->next
= *worklist
;
336 new_work_node
->node
= node
;
337 *worklist
= new_work_node
;
339 bitmap_set_bit (inserted
, node
->class_uid
);
342 /* This is a helper function for
343 vtv_compute_class_hierarchy_transitive_closure. It goes through
344 the WORKLIST of class hierarchy nodes looking for a "leaf" node,
345 i.e. a node whose children in the hierarchy have all been
346 processed. When it finds the next leaf node, it removes it from
347 the linked list (WORKLIST) and returns the node. */
349 static struct vtv_graph_node
*
350 find_and_remove_next_leaf_node (struct work_node
**worklist
)
352 struct work_node
*prev
, *cur
;
353 struct vtv_graph_node
*ret_val
= NULL
;
355 for (prev
= NULL
, cur
= *worklist
; cur
; prev
= cur
, cur
= cur
->next
)
357 if ((cur
->node
->children
).length() == cur
->node
->num_processed_children
)
360 (*worklist
) = cur
->next
;
362 prev
->next
= cur
->next
;
374 /* In our class hierarchy graph, each class node contains a bitmap,
375 with one bit for each class in the hierarchy. The bits are set for
376 classes that are descendants in the graph of the current node.
377 Initially the descendants bitmap is only set for immediate
378 descendants. This function traverses the class hierarchy graph,
379 bottom up, filling in the transitive closures for the descendants
380 as we rise up the graph. */
383 vtv_compute_class_hierarchy_transitive_closure (void)
385 struct work_node
*worklist
= NULL
;
386 sbitmap inserted
= sbitmap_alloc (num_vtable_map_nodes
);
390 /* Note: Every node in the graph gets added to the worklist exactly
391 once and removed from the worklist exactly once (when all of its
392 children have been processed). Each node's children edges are
393 followed exactly once, and each node's parent edges are followed
394 exactly once. So this algorithm is roughly O(V + 2E), i.e.
398 /* Find all the "leaf" nodes in the graph, and add them to the worklist. */
399 bitmap_clear (inserted
);
400 for (j
= 0; j
< num_vtable_map_nodes
; ++j
)
402 struct vtbl_map_node
*cur
= vtbl_map_nodes_vec
[j
];
404 && ((cur
->class_info
->children
).length() == 0)
405 && ! (bitmap_bit_p (inserted
, cur
->class_info
->class_uid
)))
406 add_to_worklist (&worklist
, cur
->class_info
, inserted
);
409 /* Main work: pull next leaf node off work list, process it, add its
410 parents to the worklist, where a 'leaf' node is one that has no
411 children, or all of its children have been processed. */
414 struct vtv_graph_node
*temp_node
=
415 find_and_remove_next_leaf_node (&worklist
);
417 gcc_assert (temp_node
!= NULL
);
418 temp_node
->descendants
= sbitmap_alloc (num_vtable_map_nodes
);
419 bitmap_clear (temp_node
->descendants
);
420 bitmap_set_bit (temp_node
->descendants
, temp_node
->class_uid
);
421 for (i
= 0; i
< (temp_node
->children
).length(); ++i
)
422 bitmap_ior (temp_node
->descendants
, temp_node
->descendants
,
423 temp_node
->children
[i
]->descendants
);
424 for (i
= 0; i
< (temp_node
->parents
).length(); ++i
)
426 temp_node
->parents
[i
]->num_processed_children
=
427 temp_node
->parents
[i
]->num_processed_children
+ 1;
428 if (!bitmap_bit_p (inserted
, temp_node
->parents
[i
]->class_uid
))
429 add_to_worklist (&worklist
, temp_node
->parents
[i
], inserted
);
434 /* Keep track of which pairs we have already created __VLTRegisterPair
435 calls for, to prevent creating duplicate calls within the same
436 compilation unit. VTABLE_DECL is the var decl for the vtable of
437 the (descendant) class that we are adding to our class hierarchy
438 data. VPTR_ADDRESS is an expression for calculating the correct
439 offset into the vtable (VTABLE_DECL). It is the actual vtable
440 pointer address that will be stored in our list of valid vtable
441 pointers for BASE_CLASS. BASE_CLASS is the record_type node for
442 the base class to whose hiearchy we want to add
443 VPTR_ADDRESS. (VTABLE_DECL should be the vtable for BASE_CLASS or
444 one of BASE_CLASS' descendents. */
447 check_and_record_registered_pairs (tree vtable_decl
, tree vptr_address
,
451 struct vtbl_map_node
*base_vtable_map_node
;
452 bool inserted_something
= false;
455 if (TREE_CODE (vptr_address
) == ADDR_EXPR
456 && TREE_CODE (TREE_OPERAND (vptr_address
, 0)) == MEM_REF
)
457 vptr_address
= TREE_OPERAND (vptr_address
, 0);
459 if (TREE_OPERAND_LENGTH (vptr_address
) > 1)
460 offset
= TREE_INT_CST_LOW (TREE_OPERAND (vptr_address
, 1));
464 base_vtable_map_node
= vtbl_map_get_node (TYPE_MAIN_VARIANT (base_class
));
466 inserted_something
= vtbl_map_node_registration_insert
467 (base_vtable_map_node
,
470 return !inserted_something
;
473 /* Given an IDENTIFIER_NODE, build and return a string literal based on it. */
476 build_string_from_id (tree identifier
)
480 gcc_assert (TREE_CODE (identifier
) == IDENTIFIER_NODE
);
482 len
= IDENTIFIER_LENGTH (identifier
);
483 return build_string_literal (len
+ 1, IDENTIFIER_POINTER (identifier
));
486 /* A class may contain secondary vtables in it, for various reasons.
487 This function goes through the decl chain of a class record looking
488 for any fields that point to secondary vtables, and adding calls to
489 __VLTRegisterPair for the secondary vtable pointers.
491 BASE_CLASS_DECL_ARG is an expression for the address of the vtable
492 map variable for the BASE_CLASS (whose hierarchy we are currently
493 updating). BASE_CLASS is the record_type node for the base class.
494 RECORD_TYPE is the record_type node for the descendant class that
495 we are possibly adding to BASE_CLASS's hierarchy. BODY is the
496 function body for the constructor init function to which we are
497 adding our calls to __VLTRegisterPair. */
500 register_construction_vtables (tree base_class
, tree record_type
,
501 vec
<tree
> *vtable_ptr_array
)
505 if (TREE_CODE (record_type
) != RECORD_TYPE
)
508 vtbl_var_decl
= CLASSTYPE_VTABLES (record_type
);
510 if (CLASSTYPE_VBASECLASSES (record_type
))
513 bool already_registered
= false;
514 tree val_vtbl_decl
= NULL_TREE
;
516 vtt_decl
= DECL_CHAIN (vtbl_var_decl
);
518 /* Check to see if we have found a VTT. Add its data if appropriate. */
521 tree values
= DECL_INITIAL (vtt_decl
);
522 if (TREE_ASM_WRITTEN (vtt_decl
)
523 && values
!= NULL_TREE
524 && TREE_CODE (values
) == CONSTRUCTOR
525 && TREE_CODE (TREE_TYPE (values
)) == ARRAY_TYPE
)
527 unsigned HOST_WIDE_INT cnt
;
530 /* Loop through the initialization values for this
531 vtable to get all the correct vtable pointer
532 addresses that we need to add to our set of valid
533 vtable pointers for the current base class. This may
534 result in adding more than just the element assigned
535 to the primary vptr of the class, so we may end up
536 with more vtable pointers than are strictly
540 vec_safe_iterate (CONSTRUCTOR_ELTS (values
),
544 tree value
= ce
->value
;
546 /* Search for the ADDR_EXPR operand within the value. */
549 && TREE_OPERAND (value
, 0)
550 && TREE_CODE (TREE_OPERAND (value
, 0)) == ADDR_EXPR
)
551 value
= TREE_OPERAND (value
, 0);
553 /* The VAR_DECL for the vtable should be the first
554 argument of the ADDR_EXPR, which is the first
557 if (TREE_OPERAND (value
, 0))
558 val_vtbl_decl
= TREE_OPERAND (value
, 0);
560 while (!VAR_P (val_vtbl_decl
)
561 && TREE_OPERAND (val_vtbl_decl
, 0))
562 val_vtbl_decl
= TREE_OPERAND (val_vtbl_decl
, 0);
564 gcc_assert (VAR_P (val_vtbl_decl
));
566 /* Check to see if we already have this vtable pointer in
567 our valid set for this base class. */
569 already_registered
= check_and_record_registered_pairs
574 if (already_registered
)
577 /* Add this vtable pointer to our set of valid
578 pointers for the base class. */
580 vtable_ptr_array
->safe_push (value
);
588 /* This function iterates through all the vtables it can find from the
589 BINFO of a class, to make sure we have found ALL of the vtables
590 that an object of that class could point to. Generate calls to
591 __VLTRegisterPair for those vtable pointers that we find.
593 BINFO is the tree_binfo node for the BASE_CLASS. BODY is the
594 function body for the constructor init function to which we are
595 adding calls to __VLTRegisterPair. ARG1 is an expression for the
596 address of the vtable map variable (for the BASE_CLASS), that will
597 point to the updated data set. BASE_CLASS is the record_type node
598 for the base class whose set of valid vtable pointers we are
599 updating. STR1 and STR2 are all debugging information, to be passed
600 as parameters to __VLTRegisterPairDebug. STR1 represents the name
601 of the vtable map variable to be updated by the call. Similarly,
602 STR2 represents the name of the class whose vtable pointer is being
603 added to the hierarchy. */
606 register_other_binfo_vtables (tree binfo
, tree base_class
,
607 vec
<tree
> *vtable_ptr_array
)
612 bool already_registered
;
614 if (binfo
== NULL_TREE
)
617 for (ix
= 0; BINFO_BASE_ITERATE (binfo
, ix
, base_binfo
); ix
++)
619 if ((!BINFO_PRIMARY_P (base_binfo
)
620 || BINFO_VIRTUAL_P (base_binfo
))
621 && (vtable_decl
= get_vtbl_decl_for_binfo (base_binfo
)))
623 tree vtable_address
= build_vtbl_address (base_binfo
);
625 already_registered
= check_and_record_registered_pairs
629 if (!already_registered
)
631 vtable_ptr_array
->safe_push (vtable_address
);
636 register_other_binfo_vtables (base_binfo
, base_class
, vtable_ptr_array
);
640 /* The set of valid vtable pointers for any given class are stored in
641 a hash table. For reasons of efficiency, that hash table size is
642 always a power of two. In order to try to prevent re-sizing the
643 hash tables very often, we pass __VLTRegisterPair an initial guess
644 as to the number of entries the hashtable will eventually need
645 (rounded up to the nearest power of two). This function takes the
646 class information we have collected for a particular class,
647 CLASS_NODE, and calculates the hash table size guess. */
650 guess_num_vtable_pointers (struct vtv_graph_node
*class_node
)
653 int total_num_vtbls
= 0;
654 int num_vtbls_power_of_two
= 1;
657 for (i
= 0; i
< num_vtable_map_nodes
; ++i
)
658 if (bitmap_bit_p (class_node
->descendants
, i
))
660 tree class_type
= vtbl_map_nodes_vec
[i
]->class_info
->class_type
;
661 for (vtbl
= CLASSTYPE_VTABLES (class_type
); vtbl
;
662 vtbl
= DECL_CHAIN (vtbl
))
665 if (total_num_vtbls
> num_vtbls_power_of_two
)
666 num_vtbls_power_of_two
<<= 1;
669 return num_vtbls_power_of_two
;
672 /* A simple hash function on strings */
673 /* Be careful about changing this routine. The values generated will
674 be stored in the calls to InitSet. So, changing this routine may
675 cause a binary incompatibility. */
678 vtv_string_hash (const char *in
)
683 gcc_assert (in
!= NULL
);
690 get_log_file_name (const char *fname
)
692 const char *tmp_dir
= concat (dump_dir_name
, NULL
);
697 dir_len
= strlen (tmp_dir
);
698 fname_len
= strlen (fname
);
700 full_name
= XNEWVEC (char, dir_len
+ fname_len
+ 1);
701 strcpy (full_name
, tmp_dir
);
702 strcpy (full_name
+ dir_len
, fname
);
708 write_out_current_set_data (tree base_class
, int set_size
)
710 static int class_data_log_fd
= -1;
712 int bytes_written
__attribute__ ((unused
));
713 char *file_name
= get_log_file_name ("vtv_class_set_sizes.log");
715 if (class_data_log_fd
== -1)
716 class_data_log_fd
= open (file_name
,
717 O_WRONLY
| O_APPEND
| O_CREAT
, S_IRWXU
);
719 if (class_data_log_fd
== -1)
721 warning_at (UNKNOWN_LOCATION
, 0,
722 "unable to open log file %<vtv_class_set_sizes.log%>: %m");
726 snprintf (buffer
, sizeof (buffer
), "%s %d\n",
727 IDENTIFIER_POINTER (DECL_ASSEMBLER_NAME (TYPE_NAME (base_class
))),
729 bytes_written
= write (class_data_log_fd
, buffer
, strlen (buffer
));
733 build_key_buffer_arg (tree base_ptr_var_decl
)
735 const int key_type_fixed_size
= 8;
736 uint32_t len1
= IDENTIFIER_LENGTH (DECL_NAME (base_ptr_var_decl
));
737 uint32_t hash_value
= vtv_string_hash (IDENTIFIER_POINTER
738 (DECL_NAME (base_ptr_var_decl
)));
739 void *key_buffer
= xmalloc (len1
+ key_type_fixed_size
);
740 uint32_t *value_ptr
= (uint32_t *) key_buffer
;
743 /* Set the len and hash for the string. */
746 *value_ptr
= hash_value
;
748 /* Now copy the string representation of the vtbl map name... */
749 memcpy ((char *) key_buffer
+ key_type_fixed_size
,
750 IDENTIFIER_POINTER (DECL_NAME (base_ptr_var_decl
)),
753 /* ... and build a string literal from it. This will make a copy
754 so the key_bufffer is not needed anymore after this. */
755 ret_value
= build_string_literal (len1
+ key_type_fixed_size
,
756 (char *) key_buffer
);
762 insert_call_to_register_set (tree class_name
,
763 vec
<tree
> *vtbl_ptr_array
, tree body
, tree arg1
,
764 tree arg2
, tree size_hint_arg
)
767 int num_args
= vtbl_ptr_array
->length();
768 char *array_arg_name
= ACONCAT (("__vptr_array_",
769 IDENTIFIER_POINTER (class_name
), NULL
));
770 tree array_arg_type
= build_array_type_nelts (build_pointer_type
774 tree array_arg
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
,
775 get_identifier (array_arg_name
),
779 vec
<constructor_elt
, va_gc
> *array_elements
;
780 vec_alloc (array_elements
, num_args
);
782 tree initial
= NULL_TREE
;
783 tree arg3
= NULL_TREE
;
785 TREE_PUBLIC (array_arg
) = 0;
786 DECL_EXTERNAL (array_arg
) = 0;
787 TREE_STATIC (array_arg
) = 1;
788 DECL_ARTIFICIAL (array_arg
) = 0;
789 TREE_READONLY (array_arg
) = 1;
790 DECL_IGNORED_P (array_arg
) = 0;
791 DECL_PRESERVE_P (array_arg
) = 0;
792 DECL_VISIBILITY (array_arg
) = VISIBILITY_HIDDEN
;
794 for (k
= 0; k
< num_args
; ++k
)
796 CONSTRUCTOR_APPEND_ELT (array_elements
, NULL_TREE
, (*vtbl_ptr_array
)[k
]);
799 initial
= build_constructor (TREE_TYPE (array_arg
), array_elements
);
801 TREE_CONSTANT (initial
) = 1;
802 TREE_STATIC (initial
) = 1;
803 DECL_INITIAL (array_arg
) = initial
;
804 relayout_decl (array_arg
);
805 varpool_node::finalize_decl (array_arg
);
807 arg3
= build1 (ADDR_EXPR
, TYPE_POINTER_TO (TREE_TYPE (array_arg
)), array_arg
);
809 TREE_TYPE (arg3
) = build_pointer_type (TREE_TYPE (array_arg
));
811 call_expr
= build_call_expr (vlt_register_set_fndecl
, 5, arg1
,
812 arg2
, /* set_symbol_key */
813 size_hint_arg
, build_int_cst (size_type_node
,
816 append_to_statement_list (call_expr
, &body
);
817 num_calls_to_regset
++;
821 insert_call_to_register_pair (vec
<tree
> *vtbl_ptr_array
, tree arg1
,
822 tree arg2
, tree size_hint_arg
, tree str1
,
823 tree str2
, tree body
)
826 int num_args
= vtbl_ptr_array
->length();
827 tree vtable_address
= NULL_TREE
;
830 vtable_address
= build_int_cst (build_pointer_type (void_type_node
), 0);
832 vtable_address
= (*vtbl_ptr_array
)[0];
835 call_expr
= build_call_expr (vlt_register_pairs_fndecl
, 6, arg1
, arg2
,
836 size_hint_arg
, vtable_address
, str1
, str2
);
838 call_expr
= build_call_expr (vlt_register_pairs_fndecl
, 4, arg1
, arg2
,
839 size_hint_arg
, vtable_address
);
841 append_to_statement_list (call_expr
, &body
);
842 num_calls_to_regpair
++;
846 output_set_info (tree record_type
, vec
<tree
> vtbl_ptr_array
)
848 static int vtv_debug_log_fd
= -1;
850 int bytes_written
__attribute__ ((unused
));
851 int array_len
= vtbl_ptr_array
.length();
852 const char *class_name
=
853 IDENTIFIER_POINTER (DECL_ASSEMBLER_NAME (TYPE_NAME (record_type
)));
854 char *file_name
= get_log_file_name ("vtv_set_ptr_data.log");
856 if (vtv_debug_log_fd
== -1)
857 vtv_debug_log_fd
= open (file_name
,
858 O_WRONLY
| O_APPEND
| O_CREAT
, S_IRWXU
);
859 if (vtv_debug_log_fd
== -1)
861 warning_at (UNKNOWN_LOCATION
, 0,
862 "unable to open log file %<vtv_set_ptr_data.log%>: %m");
866 for (int i
= 0; i
< array_len
; ++i
)
868 const char *vptr_name
= "unknown";
871 if (TREE_CODE (vtbl_ptr_array
[i
]) == POINTER_PLUS_EXPR
)
873 tree arg0
= TREE_OPERAND (vtbl_ptr_array
[i
], 0);
874 tree arg1
= TREE_OPERAND (vtbl_ptr_array
[i
], 1);
876 if (TREE_CODE (arg0
) == ADDR_EXPR
)
877 arg0
= TREE_OPERAND (arg0
, 0);
880 vptr_name
= IDENTIFIER_POINTER (DECL_NAME (arg0
));
882 if (TREE_CODE (arg1
) == INTEGER_CST
)
883 vptr_offset
= TREE_INT_CST_LOW (arg1
);
886 snprintf (buffer
, sizeof (buffer
), "%s %s %s + %d\n",
887 main_input_filename
, class_name
, vptr_name
, vptr_offset
);
888 bytes_written
= write (vtv_debug_log_fd
, buffer
, strlen(buffer
));
893 /* This function goes through our internal class hierarchy & vtable
894 pointer data structure and outputs calls to __VLTRegisterPair for
895 every class-vptr pair (for those classes whose vtable would be
896 output in the current compilation unit). These calls get put into
897 our constructor initialization function. BODY is the function
898 body, so far, of our constructor initialization function, to which we
902 register_all_pairs (tree body
)
904 bool registered_at_least_one
= false;
905 vec
<tree
> *vtbl_ptr_array
= NULL
;
908 for (j
= 0; j
< num_vtable_map_nodes
; ++j
)
910 struct vtbl_map_node
*current
= vtbl_map_nodes_vec
[j
];
912 tree base_class
= current
->class_info
->class_type
;
913 tree base_ptr_var_decl
= current
->vtbl_map_decl
;
917 tree str1
= NULL_TREE
;
918 tree str2
= NULL_TREE
;
922 gcc_assert (current
->class_info
!= NULL
);
926 str1
= build_string_from_id (DECL_NAME (base_ptr_var_decl
));
928 new_type
= build_pointer_type (TREE_TYPE (base_ptr_var_decl
));
929 arg1
= build1 (ADDR_EXPR
, new_type
, base_ptr_var_decl
);
931 /* We need a fresh vector for each iteration. */
933 vec_free (vtbl_ptr_array
);
935 vec_alloc (vtbl_ptr_array
, 10);
937 for (i
= 0; i
< num_vtable_map_nodes
; ++i
)
938 if (bitmap_bit_p (current
->class_info
->descendants
, i
))
940 struct vtbl_map_node
*vtbl_class_node
= vtbl_map_nodes_vec
[i
];
941 tree class_type
= vtbl_class_node
->class_info
->class_type
;
944 && (TREE_CODE (class_type
) == RECORD_TYPE
))
946 bool already_registered
;
948 tree binfo
= TYPE_BINFO (class_type
);
950 bool vtable_should_be_output
= false;
952 vtable_decl
= CLASSTYPE_VTABLES (class_type
);
954 /* Handle main vtable for this class. */
958 vtable_should_be_output
= TREE_ASM_WRITTEN (vtable_decl
);
959 str2
= build_string_from_id (DECL_NAME (vtable_decl
));
962 if (vtable_decl
&& vtable_should_be_output
)
964 tree vtable_address
= build_vtbl_address (binfo
);
966 already_registered
= check_and_record_registered_pairs
972 if (!already_registered
)
974 vtbl_ptr_array
->safe_push (vtable_address
);
976 /* Find and handle any 'extra' vtables associated
977 with this class, via virtual inheritance. */
978 register_construction_vtables (base_class
, class_type
,
981 /* Find and handle any 'extra' vtables associated
982 with this class, via multiple inheritance. */
983 register_other_binfo_vtables (binfo
, base_class
,
989 current_set_size
= vtbl_ptr_array
->length();
991 /* Sometimes we need to initialize the set symbol even if we are
992 not adding any vtable pointers to the set in the current
993 compilation unit. In that case, we need to initialize the
994 set to our best guess as to what the eventual size of the set
995 hash table will be (to prevent having to re-size the hash
998 size_hint
= guess_num_vtable_pointers (current
->class_info
);
1000 /* If we have added vtable pointers to the set in this
1001 compilation unit, adjust the size hint for the set's hash
1002 table appropriately. */
1003 if (vtbl_ptr_array
->length() > 0)
1005 unsigned len
= vtbl_ptr_array
->length();
1006 while ((size_t) len
> size_hint
)
1009 size_hint_arg
= build_int_cst (size_type_node
, size_hint
);
1011 /* Get the key-buffer argument. */
1012 arg2
= build_key_buffer_arg (base_ptr_var_decl
);
1014 if (str2
== NULL_TREE
)
1015 str2
= build_string_literal (strlen ("unknown") + 1,
1019 output_set_info (current
->class_info
->class_type
,
1022 if (vtbl_ptr_array
->length() > 1)
1024 insert_call_to_register_set (current
->class_name
,
1025 vtbl_ptr_array
, body
, arg1
, arg2
,
1027 registered_at_least_one
= true;
1032 if (vtbl_ptr_array
->length() > 0
1033 || (current
->is_used
1034 || (current
->registered
->size() > 0)))
1036 insert_call_to_register_pair (vtbl_ptr_array
,
1037 arg1
, arg2
, size_hint_arg
, str1
,
1039 registered_at_least_one
= true;
1043 if (flag_vtv_counts
&& current_set_size
> 0)
1044 write_out_current_set_data (base_class
, current_set_size
);
1048 return registered_at_least_one
;
1051 /* Given a tree containing a class type (CLASS_TYPE), this function
1052 finds and returns the class hierarchy node for that class in our
1055 static struct vtv_graph_node
*
1056 find_graph_node (tree class_type
)
1058 struct vtbl_map_node
*vtbl_node
;
1060 vtbl_node
= vtbl_map_get_node (TYPE_MAIN_VARIANT (class_type
));
1062 return vtbl_node
->class_info
;
1067 /* Add base class/derived class pair to our internal class hierarchy
1068 data structure. BASE_NODE is our vtv_graph_node that corresponds
1069 to a base class. DERIVED_NODE is our vtv_graph_node that
1070 corresponds to a class that is a descendant of the base class
1071 (possibly the base class itself). */
1074 add_hierarchy_pair (struct vtv_graph_node
*base_node
,
1075 struct vtv_graph_node
*derived_node
)
1077 (base_node
->children
).safe_push (derived_node
);
1078 (derived_node
->parents
).safe_push (base_node
);
1081 /* This functions adds a new base class/derived class relationship to
1082 our class hierarchy data structure. Both parameters are trees
1083 representing the class types, i.e. RECORD_TYPE trees.
1084 DERIVED_CLASS can be the same as BASE_CLASS. */
1087 update_class_hierarchy_information (tree base_class
,
1090 struct vtv_graph_node
*base_node
= find_graph_node (base_class
);
1091 struct vtv_graph_node
*derived_node
= find_graph_node (derived_class
);
1093 add_hierarchy_pair (base_node
, derived_node
);
1098 write_out_vtv_count_data (void)
1100 static int vtv_count_log_fd
= -1;
1102 int unused_vtbl_map_vars
= 0;
1103 int bytes_written
__attribute__ ((unused
));
1104 char *file_name
= get_log_file_name ("vtv_count_data.log");
1106 if (vtv_count_log_fd
== -1)
1107 vtv_count_log_fd
= open (file_name
,
1108 O_WRONLY
| O_APPEND
| O_CREAT
, S_IRWXU
);
1109 if (vtv_count_log_fd
== -1)
1111 warning_at (UNKNOWN_LOCATION
, 0,
1112 "unable to open log file %<vtv_count_data.log%>: %m");
1116 for (unsigned i
= 0; i
< num_vtable_map_nodes
; ++i
)
1118 struct vtbl_map_node
*current
= vtbl_map_nodes_vec
[i
];
1119 if (!current
->is_used
1120 && current
->registered
->size() == 0)
1121 unused_vtbl_map_vars
++;
1124 snprintf (buffer
, sizeof (buffer
), "%s %d %d %d %d %d\n",
1125 main_input_filename
, total_num_virtual_calls
,
1126 total_num_verified_vcalls
, num_calls_to_regset
,
1127 num_calls_to_regpair
, unused_vtbl_map_vars
);
1129 bytes_written
= write (vtv_count_log_fd
, buffer
, strlen (buffer
));
1132 /* This function calls register_all_pairs, which actually generates
1133 all the calls to __VLTRegisterPair (in the verification constructor
1134 init function). It also generates the calls to
1135 __VLTChangePermission, if the verification constructor init
1136 function is going into the preinit array. INIT_ROUTINE_BODY is
1137 the body of our constructior initialization function, to which we
1138 add our function calls.*/
1141 vtv_register_class_hierarchy_information (tree init_routine_body
)
1143 bool registered_something
= false;
1147 if (num_vtable_map_nodes
== 0)
1150 /* Add class hierarchy pairs to the vtable map data structure. */
1151 registered_something
= register_all_pairs (init_routine_body
);
1153 if (flag_vtv_counts
)
1154 write_out_vtv_count_data ();
1156 return registered_something
;
1160 /* Generate the special constructor function that calls
1161 __VLTChangePermission and __VLTRegisterPairs, and give it a very
1162 high initialization priority. */
1165 vtv_generate_init_routine (void)
1167 tree init_routine_body
;
1168 bool vtable_classes_found
= false;
1170 push_lang_context (lang_name_c
);
1172 /* The priority for this init function (constructor) is carefully
1173 chosen so that it will happen after the calls to unprotect the
1174 memory used for vtable verification and before the memory is
1176 init_routine_body
= vtv_start_verification_constructor_init_function ();
1178 vtable_classes_found
=
1179 vtv_register_class_hierarchy_information (init_routine_body
);
1181 if (vtable_classes_found
)
1184 vtv_finish_verification_constructor_init_function (init_routine_body
);
1185 TREE_STATIC (vtv_fndecl
) = 1;
1186 TREE_USED (vtv_fndecl
) = 1;
1187 DECL_PRESERVE_P (vtv_fndecl
) = 1;
1188 #if defined (TARGET_PECOFF)
1189 if (flag_vtable_verify
== VTV_PREINIT_PRIORITY
&& !TARGET_PECOFF
)
1191 if (flag_vtable_verify
== VTV_PREINIT_PRIORITY
)
1193 DECL_STATIC_CONSTRUCTOR (vtv_fndecl
) = 0;
1195 gimplify_function_tree (vtv_fndecl
);
1196 cgraph_node::add_new_function (vtv_fndecl
, false);
1198 symtab
->process_new_functions ();
1200 #if defined (TARGET_PECOFF)
1201 if (flag_vtable_verify
== VTV_PREINIT_PRIORITY
&& !TARGET_PECOFF
)
1203 if (flag_vtable_verify
== VTV_PREINIT_PRIORITY
)
1205 assemble_vtv_preinit_initializer (vtv_fndecl
);
1208 pop_lang_context ();
1211 /* This funtion takes a tree containing a class type (BASE_TYPE), and
1212 it either finds the existing vtbl_map_node for that class in our
1213 data structure, or it creates a new node and adds it to the data
1214 structure if there is not one for the class already. As part of
1215 this process it also creates the global vtable map variable for the
1218 struct vtbl_map_node
*
1219 vtable_find_or_create_map_decl (tree base_type
)
1221 char *var_name
= NULL
;
1222 struct vtbl_map_node
*vtable_map_node
= NULL
;
1224 /* Verify the type has an associated vtable. */
1225 if (!TYPE_BINFO (base_type
) || !BINFO_VTABLE (TYPE_BINFO (base_type
)))
1228 /* Create map lookup symbol for base class */
1229 var_name
= get_mangled_vtable_map_var_name (base_type
);
1231 /* We've already created the variable; just look it. */
1232 vtable_map_node
= vtbl_map_get_node (TYPE_MAIN_VARIANT (base_type
));
1234 if (!vtable_map_node
|| (vtable_map_node
->vtbl_map_decl
== NULL_TREE
))
1236 /* If we haven't already created the *__vtable_map global
1237 variable for this class, do so now, and add it to the
1238 varpool, to make sure it gets saved and written out. */
1240 tree var_decl
= NULL
;
1241 tree var_type
= build_pointer_type (void_type_node
);
1242 tree initial_value
= integer_zero_node
;
1244 var_decl
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
,
1245 get_identifier (var_name
), var_type
);
1247 DECL_EXTERNAL (var_decl
) = 0;
1248 TREE_STATIC (var_decl
) = 1;
1249 DECL_VISIBILITY (var_decl
) = VISIBILITY_HIDDEN
;
1250 SET_DECL_ASSEMBLER_NAME (var_decl
, get_identifier (var_name
));
1251 DECL_ARTIFICIAL (var_decl
) = 1;
1252 /* We cannot mark this variable as read-only because we want to be
1253 able to write to it at runtime. */
1254 TREE_READONLY (var_decl
) = 0;
1255 DECL_IGNORED_P (var_decl
) = 1;
1256 DECL_PRESERVE_P (var_decl
) = 1;
1258 /* Put these mmap variables in thr .vtable_map_vars section, so
1259 we can find and protect them. */
1261 set_decl_section_name (var_decl
, ".vtable_map_vars");
1262 symtab_node::get (var_decl
)->implicit_section
= true;
1263 DECL_INITIAL (var_decl
) = initial_value
;
1265 comdat_linkage (var_decl
);
1267 varpool_node::finalize_decl (var_decl
);
1268 if (!vtable_map_node
)
1270 find_or_create_vtbl_map_node (TYPE_MAIN_VARIANT (base_type
));
1271 if (vtable_map_node
->vtbl_map_decl
== NULL_TREE
)
1272 vtable_map_node
->vtbl_map_decl
= var_decl
;
1275 gcc_assert (vtable_map_node
);
1276 return vtable_map_node
;
1279 /* This function is used to build up our class hierarchy data for a
1280 particular class. TYPE is the record_type tree node for the
1284 vtv_insert_single_class_info (tree type
)
1286 if (flag_vtable_verify
)
1288 tree binfo
= TYPE_BINFO (type
);
1290 struct vtbl_map_node
*own_map
;
1293 /* First make sure to create the map for this record type. */
1294 own_map
= vtable_find_or_create_map_decl (type
);
1295 if (own_map
== NULL
)
1298 /* Go through the list of all base classes for the current
1299 (derived) type, make sure the *__vtable_map global variable
1300 for the base class exists, and add the base class/derived
1301 class pair to the class hierarchy information we are
1302 accumulating (for vtable pointer verification). */
1303 for (i
= 0; BINFO_BASE_ITERATE (binfo
, i
, base_binfo
); i
++)
1305 tree tree_val
= BINFO_TYPE (base_binfo
);
1306 struct vtbl_map_node
*vtable_map_node
= NULL
;
1308 vtable_map_node
= vtable_find_or_create_map_decl (tree_val
);
1310 if (vtable_map_node
!= NULL
)
1311 update_class_hierarchy_information (tree_val
, type
);
1316 /* This function adds classes we are interested in to a list of
1317 classes. RECORD is the record_type node for the class we are
1318 adding to the list. */
1321 vtv_save_class_info (tree record
)
1323 if (!flag_vtable_verify
|| TREE_CODE (record
) == UNION_TYPE
)
1326 if (!vlt_saved_class_info
)
1327 vec_alloc (vlt_saved_class_info
, 10);
1329 gcc_assert (TREE_CODE (record
) == RECORD_TYPE
);
1331 vec_safe_push (vlt_saved_class_info
, record
);
1335 /* This function goes through the list of classes we saved and calls
1336 vtv_insert_single_class_info on each one, to build up our class
1337 hierarchy data structure. */
1340 vtv_recover_class_info (void)
1345 if (vlt_saved_class_info
)
1347 for (i
= 0; i
< vlt_saved_class_info
->length(); ++i
)
1349 current_class
= (*vlt_saved_class_info
)[i
];
1350 gcc_assert (TREE_CODE (current_class
) == RECORD_TYPE
);
1351 vtv_insert_single_class_info (current_class
);
1356 #include "gt-cp-vtable-class-hierarchy.h"