gcc/vtable-verify.c

   1 /*   Copyright (C) 2013
   2     Free Software Foundation, Inc.
   3
   4 This file is part of GCC.
   5
   6 GCC is free software; you can redistribute it and/or modify it under
   7 the terms of the GNU General Public License as published by the Free
   8 Software Foundation; either version 3, or (at your option) any later
   9 version.
  10
  11 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  12 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14 for more details.
  15
  16 You should have received a copy of the GNU General Public License
  17 along with GCC; see the file COPYING3.  If not see
  18 <http://www.gnu.org/licenses/>.  */
  19
  20 /* Virtual Table Pointer Security Pass - Detect corruption of vtable pointers
  21    before using them for virtual method dispatches.  */
  22
  23 /* This file is part of the vtable security feature implementation.
  24    The vtable security feature is designed to detect when a virtual
  25    call is about to be made through an invalid vtable pointer
  26    (possibly due to data corruption or malicious attacks). The
  27    compiler finds every virtual call, and inserts a verification call
  28    before the virtual call.  The verification call takes the actual
  29    vtable pointer value in the object through which the virtual call
  30    is being made, and compares the vtable pointer against a set of all
  31    valid vtable pointers that the object could contain (this set is
  32    based on the declared type of the object).  If the pointer is in
  33    the valid set, execution is allowed to continue; otherwise the
  34    program is halted.
  35
  36   There are several pieces needed in order to make this work: 1. For
  37   every virtual class in the program (i.e. a class that contains
  38   virtual methods), we need to build the set of all possible valid
  39   vtables that an object of that class could point to.  This includes
  40   vtables for any class(es) that inherit from the class under
  41   consideration.  2. For every such data set we build up, we need a
  42   way to find and reference the data set.  This is complicated by the
  43   fact that the real vtable addresses are not known until runtime,
  44   when the program is loaded into memory, but we need to reference the
  45   sets at compile time when we are inserting verification calls into
  46   the program.  3.  We need to find every virtual call in the program,
  47   and insert the verification call (with the appropriate arguments)
  48   before the virtual call.  4. We need some runtime library pieces:
  49   the code to build up the data sets at runtime; the code to actually
  50   perform the verification using the data sets; and some code to set
  51   protections on the data sets, so they themselves do not become
  52   hacker targets.
  53
  54   To find and reference the set of valid vtable pointers for any given
  55   virtual class, we create a special global variable for each virtual
  56   class.  We refer to this as the "vtable map variable" for that
  57   class.  The vtable map variable has the type "void *", and is
  58   initialized by the compiler to NULL.  At runtime when the set of
  59   valid vtable pointers for a virtual class, e.g. class Foo, is built,
  60   the vtable map variable for class Foo is made to point to the set.
  61   During compile time, when the compiler is inserting verification
  62   calls into the program, it passes the vtable map variable for the
  63   appropriate class to the verification call, so that at runtime the
  64   verification call can find the appropriate data set.
  65
  66   The actual set of valid vtable pointers for a virtual class,
  67   e.g. class Foo, cannot be built until runtime, when the vtables get
  68   loaded into memory and their addresses are known.  But the knowledge
  69   about which vtables belong in which class' hierarchy is only known
  70   at compile time.  Therefore at compile time we collect class
  71   hierarchy and vtable information about every virtual class, and we
  72   generate calls to build up the data sets at runtime.  To build the
  73   data sets, we call one of the functions we add to the runtime
  74   library, __VLTRegisterPair.  __VLTRegisterPair takes two arguments,
  75   a vtable map variable and the address of a vtable.  If the vtable
  76   map variable is currently NULL, it creates a new data set (hash
  77   table), makes the vtable map variable point to the new data set, and
  78   inserts the vtable address into the data set.  If the vtable map
  79   variable is not NULL, it just inserts the vtable address into the
  80   data set.  In order to make sure that our data sets are built before
  81   any verification calls happen, we create a special constructor
  82   initialization function for each compilation unit, give it a very
  83   high initialization priority, and insert all of our calls to
  84   __VLTRegisterPair into our special constructor initialization
  85   function.
  86
  87   The vtable verification feature is controlled by the flag
  88   '-fvtable-verify='.  There are three flavors of this:
  89   '-fvtable-verify=std', '-fvtable-verify=preinit', and
  90   '-fvtable-verify=none'.  If the option '-fvtable-verfy=preinit' is
  91   used, then our constructor initialization function gets put into the
  92   preinit array.  This is necessary if there are data sets that need
  93   to be built very early in execution.  If the constructor
  94   initialization function gets put into the preinit array, the we also
  95   add calls to __VLTChangePermission at the beginning and end of the
  96   function.  The call at the beginning sets the permissions on the
  97   data sets and vtable map variables to read/write, and the one at the
  98   end makes them read-only.  If the '-fvtable-verify=std' option is
  99   used, the constructor initialization functions are executed at their
 100   normal time, and the __VLTChangePermission calls are handled
 101   differently (see the comments in libstdc++-v3/libsupc++/vtv_rts.cc).
 102   The option '-fvtable-verify=none' turns off vtable verification.
 103
 104   This file contains code for the tree pass that goes through all the
 105   statements in each basic block, looking for virtual calls, and
 106   inserting a call to __VLTVerifyVtablePointer (with appropriate
 107   arguments) before each one.  It also contains the hash table
 108   functions for the data structures used for collecting the class
 109   hierarchy data and building/maintaining the vtable map variable data
 110   are defined in gcc/vtable-verify.h.  These data structures are
 111   shared with the code in the C++ front end that collects the class
 112   hierarchy & vtable information and generates the vtable map
 113   variables (see cp/vtable-class-hierarchy.c).  This tree pass should
 114   run just before the gimple is converted to RTL.
 115
 116   Some implementation details for this pass:
 117
 118   To find all of the virtual calls, we iterate through all the
 119   gimple statements in each basic block, looking for any call
 120   statement with the code "OBJ_TYPE_REF".  Once we have found the
 121   virtual call, we need to find the vtable pointer through which the
 122   call is being made, and the type of the object containing the
 123   pointer (to find the appropriate vtable map variable).  We then use
 124   these to build a call to __VLTVerifyVtablePointer, passing the
 125   vtable map variable, and the vtable pointer.  We insert the
 126   verification call just after the gimple statement that gets the
 127   vtable pointer out of the object, and we update the next
 128   statement to depend on the result returned from
 129   __VLTVerifyVtablePointer (the vtable pointer value), to ensure
 130   subsequent compiler phases don't remove or reorder the call (it's no
 131   good to have the verification occur after the virtual call, for
 132   example).  To find the vtable pointer being used (and the type of
 133   the object) we search backwards through the def_stmts chain from the
 134   virtual call (see verify_bb_vtables for more details).  */
 135
 136 #include "config.h"
 137 #include "system.h"
 138 #include "coretypes.h"
 139 #include "tree.h"
 140 #include "basic-block.h"
 141 #include "gimple.h"
 142 #include "gimple-iterator.h"
 143 #include "gimple-ssa.h"
 144 #include "tree-phinodes.h"
 145 #include "ssa-iterators.h"
 146 #include "tree-ssanames.h"
 147 #include "tree-pass.h"
 148 #include "cfgloop.h"
 149
 150 #include "vtable-verify.h"
 151
 152 unsigned num_vtable_map_nodes = 0;
 153 int total_num_virtual_calls = 0;
 154 int total_num_verified_vcalls = 0;
 155
 156 extern GTY(()) tree verify_vtbl_ptr_fndecl;
 157 tree verify_vtbl_ptr_fndecl = NULL_TREE;
 158
 159 /* Keep track of whether or not any virtual call were verified.  */
 160 static bool any_verification_calls_generated = false;
 161
 162 unsigned int vtable_verify_main (void);
 163
 164
 165 /* The following few functions are for the vtbl pointer hash table
 166    in the 'registered' field of the struct vtable_map_node.  The hash
 167    table keeps track of which vtable pointers have been used in
 168    calls to __VLTRegisterPair with that particular vtable map variable.  */
 169
 170 /* This function checks to see if a particular VTABLE_DECL and OFFSET are
 171    already in the 'registered' hash table for NODE.  */
 172
 173 bool
 174 vtbl_map_node_registration_find (struct vtbl_map_node *node,
 175                                  tree vtable_decl,
 176                                  unsigned offset)
 177 {
 178   struct vtable_registration key;
 179   struct vtable_registration **slot;
 180
 181   gcc_assert (node && node->registered.is_created ());
 182
 183   key.vtable_decl = vtable_decl;
 184   slot = (struct vtable_registration **) node->registered.find_slot (&key,
 185                                                                      NO_INSERT);
 186
 187   if (slot && (*slot))
 188     {
 189       unsigned i;
 190       for (i = 0; i < ((*slot)->offsets).length (); ++i)
 191         if ((*slot)->offsets[i] == offset)
 192           return true;
 193     }
 194
 195   return false;
 196 }
 197
 198 /* This function inserts VTABLE_DECL and OFFSET into the 'registered'
 199    hash table for NODE.  It returns a boolean indicating whether or not
 200    it actually inserted anything.  */
 201
 202 bool
 203 vtbl_map_node_registration_insert (struct vtbl_map_node *node,
 204                                    tree vtable_decl,
 205                                    unsigned offset)
 206 {
 207   struct vtable_registration key;
 208   struct vtable_registration **slot;
 209   bool inserted_something = false;
 210
 211   if (!node || !node->registered.is_created ())
 212     return false;
 213
 214   key.vtable_decl = vtable_decl;
 215   slot = (struct vtable_registration **) node->registered.find_slot (&key,
 216                                                                      INSERT);
 217
 218   if (! *slot)
 219     {
 220       struct vtable_registration *node;
 221       node = XNEW (struct vtable_registration);
 222       node->vtable_decl = vtable_decl;
 223
 224       (node->offsets).create (10);
 225       (node->offsets).safe_push (offset);
 226       *slot = node;
 227       inserted_something = true;
 228     }
 229   else
 230     {
 231       /* We found the vtable_decl slot; we need to see if it already
 232          contains the offset.  If not, we need to add the offset.  */
 233       unsigned i;
 234       bool found = false;
 235       for (i = 0; i < ((*slot)->offsets).length () && !found; ++i)
 236         if ((*slot)->offsets[i] == offset)
 237           found = true;
 238
 239       if (!found)
 240         {
 241           ((*slot)->offsets).safe_push (offset);
 242           inserted_something = true;
 243         }
 244      }
 245   return inserted_something;
 246 }
 247
 248 /* Hashtable functions for vtable_registration hashtables.  */
 249
 250 inline hashval_t
 251 registration_hasher::hash (const value_type *p)
 252 {
 253   const struct vtable_registration *n = (const struct vtable_registration *) p;
 254   return (hashval_t) (DECL_UID (n->vtable_decl));
 255 }
 256
 257 inline bool
 258 registration_hasher::equal (const value_type *p1, const compare_type *p2)
 259 {
 260   const struct vtable_registration *n1 =
 261                                     (const struct vtable_registration *) p1;
 262   const struct vtable_registration *n2 =
 263                                     (const struct vtable_registration *) p2;
 264   return (DECL_UID (n1->vtable_decl) == DECL_UID (n2->vtable_decl));
 265 }
 266
 267 /* End of hashtable functions for "registered" hashtables.  */
 268
 269
 270
 271 /* Hashtable definition and functions for vtbl_map_hash.  */
 272
 273 struct vtbl_map_hasher : typed_noop_remove <struct vtbl_map_node>
 274 {
 275   typedef struct vtbl_map_node value_type;
 276   typedef struct vtbl_map_node compare_type;
 277   static inline hashval_t hash (const value_type *);
 278   static inline bool equal (const value_type *, const compare_type *);
 279 };
 280
 281 /* Returns a hash code for P.  */
 282
 283 inline hashval_t
 284 vtbl_map_hasher::hash (const value_type *p)
 285 {
 286   const struct vtbl_map_node n = *((const struct vtbl_map_node *) p);
 287   return (hashval_t) IDENTIFIER_HASH_VALUE (n.class_name);
 288 }
 289
 290 /* Returns nonzero if P1 and P2 are equal.  */
 291
 292 inline bool
 293 vtbl_map_hasher::equal (const value_type *p1, const compare_type *p2)
 294 {
 295   const struct vtbl_map_node n1 = *((const struct vtbl_map_node *) p1);
 296   const struct vtbl_map_node n2 = *((const struct vtbl_map_node *) p2);
 297   return (IDENTIFIER_HASH_VALUE (n1.class_name) ==
 298           IDENTIFIER_HASH_VALUE (n2.class_name));
 299 }
 300
 301 /* Here are the two structures into which we insert vtable map nodes.
 302    We use two data structures because of the vastly different ways we need
 303    to find the nodes for various tasks (see comments in vtable-verify.h
 304    for more details.  */
 305
 306 typedef hash_table <vtbl_map_hasher> vtbl_map_table_type;
 307 typedef vtbl_map_table_type::iterator vtbl_map_iterator_type;
 308
 309 /* Vtable map variable nodes stored in a hash table.  */
 310 static vtbl_map_table_type vtbl_map_hash;
 311
 312 /* Vtable map variable nodes stored in a vector.  */
 313 vec<struct vtbl_map_node *> vtbl_map_nodes_vec;
 314
 315 /* Return vtbl_map node for CLASS_NAME  without creating a new one.  */
 316
 317 struct vtbl_map_node *
 318 vtbl_map_get_node (tree class_type)
 319 {
 320   struct vtbl_map_node key;
 321   struct vtbl_map_node **slot;
 322
 323   tree class_type_decl;
 324   tree class_name;
 325   unsigned int type_quals;
 326
 327   if (!vtbl_map_hash.is_created ())
 328     return NULL;
 329
 330   gcc_assert (TREE_CODE (class_type) == RECORD_TYPE);
 331
 332
 333   /* Find the TYPE_DECL for the class.  */
 334   class_type_decl = TYPE_NAME (class_type);
 335
 336   /* Verify that there aren't any qualifiers on the type.  */
 337   type_quals = TYPE_QUALS (TREE_TYPE (class_type_decl));
 338   gcc_assert (type_quals == TYPE_UNQUALIFIED);
 339
 340   /* Get the mangled name for the unqualified type.  */
 341   gcc_assert (HAS_DECL_ASSEMBLER_NAME_P (class_type_decl));
 342   class_name = DECL_ASSEMBLER_NAME (class_type_decl);
 343
 344   key.class_name = class_name;
 345   slot = (struct vtbl_map_node **) vtbl_map_hash.find_slot (&key,
 346                                                             NO_INSERT);
 347   if (!slot)
 348     return NULL;
 349   return *slot;
 350 }
 351
 352 /* Return vtbl_map node assigned to BASE_CLASS_TYPE.  Create new one
 353    when needed.  */
 354
 355 struct vtbl_map_node *
 356 find_or_create_vtbl_map_node (tree base_class_type)
 357 {
 358   struct vtbl_map_node key;
 359   struct vtbl_map_node *node;
 360   struct vtbl_map_node **slot;
 361   tree class_type_decl;
 362   unsigned int type_quals;
 363
 364   if (!vtbl_map_hash.is_created ())
 365     vtbl_map_hash.create (10);
 366
 367   /* Find the TYPE_DECL for the class.  */
 368   class_type_decl = TYPE_NAME (base_class_type);
 369
 370   /* Verify that there aren't any type qualifiers on type.  */
 371   type_quals = TYPE_QUALS (TREE_TYPE (class_type_decl));
 372   gcc_assert (type_quals == TYPE_UNQUALIFIED);
 373
 374   gcc_assert (HAS_DECL_ASSEMBLER_NAME_P (class_type_decl));
 375   key.class_name = DECL_ASSEMBLER_NAME (class_type_decl);
 376   slot = (struct vtbl_map_node **) vtbl_map_hash.find_slot (&key,
 377                                                             INSERT);
 378
 379   if (*slot)
 380     return *slot;
 381
 382   node = XNEW (struct vtbl_map_node);
 383   node->vtbl_map_decl = NULL_TREE;
 384   node->class_name = key.class_name;
 385   node->uid = num_vtable_map_nodes++;
 386
 387   node->class_info = XNEW (struct vtv_graph_node);
 388   node->class_info->class_type = base_class_type;
 389   node->class_info->class_uid = node->uid;
 390   node->class_info->num_processed_children = 0;
 391
 392   (node->class_info->parents).create (4);
 393   (node->class_info->children).create (4);
 394
 395   node->registered.create (16);
 396
 397   node->is_used = false;
 398
 399   vtbl_map_nodes_vec.safe_push (node);
 400   gcc_assert (vtbl_map_nodes_vec[node->uid] == node);
 401
 402   *slot = node;
 403   return node;
 404 }
 405
 406 /* End of hashtable functions for vtable_map variables hash table.   */
 407
 408 /* Given a gimple STMT, this function checks to see if the statement
 409    is an assignment, the rhs of which is getting the vtable pointer
 410    value out of an object.  (i.e. it's the value we need to verify
 411    because its the vtable pointer that will be used for a virtual
 412    call).  */
 413
 414 static bool
 415 is_vtable_assignment_stmt (gimple stmt)
 416 {
 417
 418   if (gimple_code (stmt) != GIMPLE_ASSIGN)
 419     return false;
 420   else
 421     {
 422       tree lhs = gimple_assign_lhs (stmt);
 423       tree rhs = gimple_assign_rhs1 (stmt);
 424
 425       if (TREE_CODE (lhs) != SSA_NAME)
 426         return false;
 427
 428       if (TREE_CODE (rhs) != COMPONENT_REF)
 429         return false;
 430
 431       if (! (TREE_OPERAND (rhs, 1))
 432           || (TREE_CODE (TREE_OPERAND (rhs, 1)) != FIELD_DECL))
 433         return false;
 434
 435       if (! DECL_VIRTUAL_P (TREE_OPERAND (rhs, 1)))
 436         return false;
 437     }
 438
 439     return true;
 440 }
 441
 442 /* This function attempts to recover the declared class of an object
 443    that is used in making a virtual call.  We try to get the type from
 444    the type cast in the gimple assignment statement that extracts the
 445    vtable pointer from the object (DEF_STMT).  The gimple statement
 446    usually looks something like this:
 447
 448    D.2201_4 = MEM[(struct Event *)this_1(D)]._vptr.Event    */
 449
 450 static tree
 451 extract_object_class_type (tree rhs)
 452 {
 453   tree result = NULL_TREE;
 454
 455   /* Try to find and extract the type cast from that stmt.  */
 456   if (TREE_CODE (rhs) == COMPONENT_REF)
 457     {
 458       tree op0 = TREE_OPERAND (rhs, 0);
 459       tree op1 = TREE_OPERAND (rhs, 1);
 460
 461       if (TREE_CODE (op1) == FIELD_DECL
 462           && DECL_VIRTUAL_P (op1))
 463         {
 464           if (TREE_CODE (op0) == COMPONENT_REF
 465               && TREE_CODE (TREE_OPERAND (op0, 0)) == MEM_REF
 466               && TREE_CODE (TREE_TYPE (TREE_OPERAND (op0, 0)))== RECORD_TYPE)
 467             result = TREE_TYPE (TREE_OPERAND (op0, 0));
 468           else
 469             result = TREE_TYPE (op0);
 470         }
 471       else if (TREE_CODE (op0) == COMPONENT_REF)
 472         {
 473           result = extract_object_class_type (op0);
 474           if (result == NULL_TREE
 475               && TREE_CODE (op1) == COMPONENT_REF)
 476             result = extract_object_class_type (op1);
 477         }
 478     }
 479
 480   return result;
 481 }
 482
 483 /* This function traces forward through the def-use chain of an SSA
 484    variable to see if it ever gets used in a virtual function call.  It
 485    returns a boolean indicating whether or not it found a virtual call in
 486    the use chain.  */
 487
 488 static bool
 489 var_is_used_for_virtual_call_p (tree lhs, int *mem_ref_depth)
 490 {
 491   imm_use_iterator imm_iter;
 492   bool found_vcall = false;
 493   use_operand_p use_p;
 494
 495   if (TREE_CODE (lhs) != SSA_NAME)
 496     return false;
 497
 498   if (*mem_ref_depth > 2)
 499     return false;
 500
 501   /* Iterate through the immediate uses of the current variable.  If
 502      it's a virtual function call, we're done.  Otherwise, if there's
 503      an LHS for the use stmt, add the ssa var to the work list
 504      (assuming it's not already in the list and is not a variable
 505      we've already examined.  */
 506
 507   FOR_EACH_IMM_USE_FAST (use_p, imm_iter, lhs)
 508     {
 509       gimple stmt2 = USE_STMT (use_p);
 510
 511       if (gimple_code (stmt2) == GIMPLE_CALL)
 512         {
 513           tree fncall = gimple_call_fn (stmt2);
 514           if (TREE_CODE (fncall) == OBJ_TYPE_REF)
 515             found_vcall = true;
 516           else
 517             return false;
 518         }
 519       else if (gimple_code (stmt2) == GIMPLE_PHI)
 520         {
 521           found_vcall = var_is_used_for_virtual_call_p
 522                                                     (gimple_phi_result (stmt2),
 523                                                      mem_ref_depth);
 524         }
 525       else if (gimple_code (stmt2) == GIMPLE_ASSIGN)
 526         {
 527           tree rhs = gimple_assign_rhs1 (stmt2);
 528           if (TREE_CODE (rhs) == ADDR_EXPR
 529               || TREE_CODE (rhs) == MEM_REF)
 530             *mem_ref_depth = *mem_ref_depth + 1;
 531
 532           if (TREE_CODE (rhs) == COMPONENT_REF)
 533             {
 534               while (TREE_CODE (TREE_OPERAND (rhs, 0)) == COMPONENT_REF)
 535                 rhs = TREE_OPERAND (rhs, 0);
 536
 537               if (TREE_CODE (TREE_OPERAND (rhs, 0)) == ADDR_EXPR
 538                   || TREE_CODE (TREE_OPERAND (rhs, 0)) == MEM_REF)
 539                 *mem_ref_depth = *mem_ref_depth + 1;
 540             }
 541
 542           if (*mem_ref_depth < 3)
 543             found_vcall = var_is_used_for_virtual_call_p
 544                                                     (gimple_assign_lhs (stmt2),
 545                                                      mem_ref_depth);
 546         }
 547
 548       else
 549         break;
 550
 551       if (found_vcall)
 552         return true;
 553     }
 554
 555   return false;
 556 }
 557
 558 /* Search through all the statements in a basic block (BB), searching
 559    for virtual method calls.  For each virtual method dispatch, find
 560    the vptr value used, and the statically declared type of the
 561    object; retrieve the vtable map variable for the type of the
 562    object; generate a call to __VLTVerifyVtablePointer; and insert the
 563    generated call into the basic block, after the point where the vptr
 564    value is gotten out of the object and before the virtual method
 565    dispatch. Make the virtual method dispatch depend on the return
 566    value from the verification call, so that subsequent optimizations
 567    cannot reorder the two calls.  */
 568
 569 static void
 570 verify_bb_vtables (basic_block bb)
 571 {
 572   gimple_seq stmts;
 573   gimple stmt = NULL;
 574   gimple_stmt_iterator gsi_vtbl_assign;
 575   gimple_stmt_iterator gsi_virtual_call;
 576
 577   stmts = bb_seq (bb);
 578   gsi_virtual_call = gsi_start (stmts);
 579   for (; !gsi_end_p (gsi_virtual_call); gsi_next (&gsi_virtual_call))
 580     {
 581       stmt = gsi_stmt (gsi_virtual_call);
 582
 583       /* Count virtual calls.  */
 584       if (gimple_code (stmt) == GIMPLE_CALL)
 585         {
 586           tree fncall = gimple_call_fn (stmt);
 587           if (TREE_CODE (fncall) == OBJ_TYPE_REF)
 588             total_num_virtual_calls++;
 589         }
 590
 591       if (is_vtable_assignment_stmt (stmt))
 592         {
 593           tree lhs = gimple_assign_lhs (stmt);
 594           tree vtbl_var_decl = NULL_TREE;
 595           struct vtbl_map_node *vtable_map_node;
 596           tree vtbl_decl = NULL_TREE;
 597           gimple call_stmt;
 598           const char *vtable_name = "<unknown>";
 599           tree tmp0;
 600           bool found;
 601           int mem_ref_depth = 0;
 602
 603           /* Make sure this vptr field access is for a virtual call.  */
 604           if (!var_is_used_for_virtual_call_p (lhs, &mem_ref_depth))
 605             continue;
 606
 607           /* Now we have found the virtual method dispatch and
 608              the preceding access of the _vptr.* field... Next
 609              we need to find the statically declared type of
 610              the object, so we can find and use the right
 611              vtable map variable in the verification call.  */
 612           tree class_type = extract_object_class_type
 613                                                    (gimple_assign_rhs1 (stmt));
 614
 615           gsi_vtbl_assign = gsi_for_stmt (stmt);
 616
 617           if (class_type
 618               && (TREE_CODE (class_type) == RECORD_TYPE)
 619               && TYPE_BINFO (class_type))
 620             {
 621               /* Get the vtable VAR_DECL for the type.  */
 622               vtbl_var_decl = BINFO_VTABLE (TYPE_BINFO (class_type));
 623
 624               if (TREE_CODE (vtbl_var_decl) == POINTER_PLUS_EXPR)
 625                 vtbl_var_decl = TREE_OPERAND (TREE_OPERAND (vtbl_var_decl, 0),
 626                                               0);
 627
 628               gcc_assert (vtbl_var_decl);
 629
 630               vtbl_decl = vtbl_var_decl;
 631               vtable_map_node = vtbl_map_get_node
 632                                                (TYPE_MAIN_VARIANT (class_type));
 633
 634               gcc_assert (verify_vtbl_ptr_fndecl);
 635
 636               /* Given the vtable pointer for the base class of the
 637                  object, build the call to __VLTVerifyVtablePointer to
 638                  verify that the object's vtable pointer (contained in
 639                  lhs) is in the set of valid vtable pointers for the
 640                  base class.  */
 641
 642               if (vtable_map_node && vtable_map_node->vtbl_map_decl)
 643                 {
 644                   use_operand_p use_p;
 645                   ssa_op_iter iter;
 646
 647                   vtable_map_node->is_used = true;
 648                   vtbl_var_decl = vtable_map_node->vtbl_map_decl;
 649
 650                   if (TREE_CODE (vtbl_decl) == VAR_DECL)
 651                     vtable_name = IDENTIFIER_POINTER (DECL_NAME (vtbl_decl));
 652
 653                   /* Call different routines if we are interested in
 654                      trace information to debug problems.  */
 655                   if (flag_vtv_debug)
 656                     {
 657                       int len1 = IDENTIFIER_LENGTH
 658                                                  (DECL_NAME (vtbl_var_decl));
 659                       int len2 = strlen (vtable_name);
 660
 661                       call_stmt = gimple_build_call
 662                                      (verify_vtbl_ptr_fndecl, 4,
 663                                       build1 (ADDR_EXPR,
 664                                                 TYPE_POINTER_TO
 665                                                   (TREE_TYPE (vtbl_var_decl)),
 666                                               vtbl_var_decl),
 667                                       lhs,
 668                                       build_string_literal
 669                                                   (len1 + 1,
 670                                                    IDENTIFIER_POINTER
 671                                                        (DECL_NAME
 672                                                             (vtbl_var_decl))),
 673                                       build_string_literal (len2 + 1,
 674                                                             vtable_name));
 675                     }
 676                   else
 677                     call_stmt = gimple_build_call
 678                                      (verify_vtbl_ptr_fndecl, 2,
 679                                       build1 (ADDR_EXPR,
 680                                                 TYPE_POINTER_TO
 681                                                   (TREE_TYPE (vtbl_var_decl)),
 682                                                  vtbl_var_decl),
 683                                       lhs);
 684
 685
 686                   /* Create a new SSA_NAME var to hold the call's
 687                      return value, and make the call_stmt use the
 688                      variable for that purpose.  */
 689                   tmp0 = make_temp_ssa_name (TREE_TYPE (lhs), NULL, "VTV");
 690                   gimple_call_set_lhs (call_stmt, tmp0);
 691                   update_stmt (call_stmt);
 692
 693                   /* Find the next stmt, after the vptr assignment
 694                      statememt, which should use the result of the
 695                      vptr assignment statement value. */
 696                   gsi_next (&gsi_vtbl_assign);
 697                   gimple next_stmt = gsi_stmt (gsi_vtbl_assign);
 698
 699                   if (!next_stmt)
 700                     return;
 701
 702                   /* Find any/all uses of 'lhs' in next_stmt, and
 703                      replace them with 'tmp0'.  */
 704                   found = false;
 705                   FOR_EACH_PHI_OR_STMT_USE (use_p, next_stmt, iter,
 706                                             SSA_OP_ALL_USES)
 707                     {
 708                       tree op = USE_FROM_PTR (use_p);
 709                       if (op == lhs)
 710                         {
 711                           SET_USE (use_p, tmp0);
 712                           found = true;
 713                         }
 714                     }
 715                   update_stmt (next_stmt);
 716                   gcc_assert (found);
 717
 718                   /* Insert the new verification call just after the
 719                      statement that gets the vtable pointer out of the
 720                      object.  */
 721                   gsi_vtbl_assign = gsi_for_stmt (stmt);
 722                   gsi_insert_after (&gsi_vtbl_assign, call_stmt,
 723                                     GSI_NEW_STMT);
 724
 725                   any_verification_calls_generated = true;
 726                   total_num_verified_vcalls++;
 727                 }
 728             }
 729         }
 730     }
 731 }
 732
 733 /* Main function, called from pass->excute().  Loop through all the
 734    basic blocks in the current function, passing them to
 735    verify_bb_vtables, which searches for virtual calls, and inserts
 736    calls to __VLTVerifyVtablePointer.  */
 737
 738 unsigned int
 739 vtable_verify_main (void)
 740 {
 741   unsigned int ret = 1;
 742   basic_block bb;
 743
 744   FOR_ALL_BB (bb)
 745       verify_bb_vtables (bb);
 746
 747   return ret;
 748 }
 749
 750 /* Gate function for the pass.  */
 751
 752 static bool
 753 gate_tree_vtable_verify (void)
 754 {
 755   return (flag_vtable_verify);
 756 }
 757
 758 /* Definition of this optimization pass.  */
 759
 760 namespace {
 761
 762 const pass_data pass_data_vtable_verify =
 763 {
 764   GIMPLE_PASS, /* type */
 765   "vtable-verify", /* name */
 766   OPTGROUP_NONE, /* optinfo_flags */
 767   true, /* has_gate */
 768   true, /* has_execute */
 769   TV_VTABLE_VERIFICATION, /* tv_id */
 770   ( PROP_cfg | PROP_ssa ), /* properties_required */
 771   0, /* properties_provided */
 772   0, /* properties_destroyed */
 773   0, /* todo_flags_start */
 774   TODO_update_ssa, /* todo_flags_finish */
 775 };
 776
 777 class pass_vtable_verify : public gimple_opt_pass
 778 {
 779 public:
 780   pass_vtable_verify (gcc::context *ctxt)
 781     : gimple_opt_pass (pass_data_vtable_verify, ctxt)
 782   {}
 783
 784   /* opt_pass methods: */
 785   bool gate () { return gate_tree_vtable_verify (); }
 786   unsigned int execute () { return vtable_verify_main (); }
 787
 788 }; // class pass_vtable_verify
 789
 790 } // anon namespace
 791
 792 gimple_opt_pass *
 793 make_pass_vtable_verify (gcc::context *ctxt)
 794 {
 795   return new pass_vtable_verify (ctxt);
 796 }
 797
 798 #include "gt-vtable-verify.h"