1 /* Copyright (C) 2012-2013 Free Software Foundation, Inc.
3 This file is part of GCC.
5 GCC is free software; you can redistribute it and/or modify it
6 under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 3, or (at your option)
10 GCC is distributed in the hope that it will be useful, but
11 WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with GCC; see the file COPYING3. If not see
17 <http://www.gnu.org/licenses/>. */
19 /* Virtual Table Pointer Security Pass - Detect corruption of vtable pointers
20 before using them for virtual method dispatches. */
22 /* This file is part of the vtable security feature implementation.
23 The vtable security feature is designed to detect when a virtual
24 call is about to be made through an invalid vtable pointer
25 (possibly due to data corruption or malicious attacks). The
26 compiler finds every virtual call, and inserts a verification call
27 before the virtual call. The verification call takes the actual
28 vtable pointer value in the object through which the virtual call
29 is being made, and compares the vtable pointer against a set of all
30 valid vtable pointers that the object could contain (this set is
31 based on the declared type of the object). If the pointer is in
32 the valid set, execution is allowed to continue; otherwise the
35 There are several pieces needed in order to make this work: 1. For
36 every virtual class in the program (i.e. a class that contains
37 virtual methods), we need to build the set of all possible valid
38 vtables that an object of that class could point to. This includes
39 vtables for any class(es) that inherit from the class under
40 consideration. 2. For every such data set we build up, we need a
41 way to find and reference the data set. This is complicated by the
42 fact that the real vtable addresses are not known until runtime,
43 when the program is loaded into memory, but we need to reference the
44 sets at compile time when we are inserting verification calls into
45 the program. 3. We need to find every virtual call in the program,
46 and insert the verification call (with the appropriate arguments)
47 before the virtual call. 4. We need some runtime library pieces:
48 the code to build up the data sets at runtime; the code to actually
49 perform the verification using the data sets; and some code to set
50 protections on the data sets, so they themselves do not become
53 To find and reference the set of valid vtable pointers for any given
54 virtual class, we create a special global varible for each virtual
55 class. We refer to this as the "vtable map variable" for that
56 class. The vtable map variable has the type "void *", and is
57 initialized by the compiler to NULL. At runtime when the set of
58 valid vtable pointers for a virtual class, e.g. class Foo, is built,
59 the vtable map variable for class Foo is made to point to the set.
60 During compile time, when the compiler is inserting verification
61 calls into the program, it passes the vtable map variable for the
62 appropriate class to the verification call, so that at runtime the
63 verification call can find the appropriate data set.
65 The actual set of valid vtable pointers for a virtual class,
66 e.g. class Foo, cannot be built until runtime, when the vtables get
67 loaded into memory and their addresses are known. But the knowledge
68 about which vtables belong in which class' hierarchy is only known
69 at compile time. Therefore at compile time we collect class
70 hierarchy and vtable information about every virtual class, and we
71 generate calls to build up the data sets at runtime. To build the
72 data sets, we call one of the functions we add to the runtime
73 library, __VLTRegisterPair. __VLTRegisterPair takes two arguments,
74 a vtable map variable and the address of a vtable. If the vtable
75 map variable is currently NULL, it creates a new data set (hash
76 table), makes the vtable map variable point to the new data set, and
77 inserts the vtable address into the data set. If the vtable map
78 variable is not NULL, it just inserts the vtable address into the
79 data set. In order to make sure that our data sets are built before
80 any verification calls happen, we create a special constructor
81 initialization function for each compilation unit, give it a very
82 high initialization priority, and insert all of our calls to
83 __VLTRegisterPair into our special constructor initialization
86 The vtable verification feature is controlled by the flag
87 '-fvtable-verify='. There are three flavors of this:
88 '-fvtable-verify=std', '-fvtable-verify=preinit', and
89 '-fvtable-verify=none'. If the option '-fvtable-verfy=preinit' is
90 used, then our constructor initialization function gets put into the
91 preinit array. This is necessary if there are data sets that need
92 to be built very early in execution. If the constructor
93 initialization function gets put into the preinit array, the we also
94 add calls to __VLTChangePermission at the beginning and end of the
95 function. The call at the beginning sets the permissions on the
96 data sets and vtable map variables to read/write, and the one at the
97 end makes them read-only. If the '-fvtable-verify=std' option is
98 used, the constructor initialization functions are executed at their
99 normal time, and the __VLTChangePermission calls are handled
100 differently (see the comments in libstdc++-v3/libsupc++/vtv_rts.cc).
101 The option '-fvtable-verify=none' turns off vtable verification.
103 This file contains code to find and record the class hierarchies for
104 the virtual classes in a program, and all the vtables associated
105 with each such class; to generate the vtable map variables; and to
106 generate the constructor initialization function (with the calls to
107 __VLTRegisterPair, and __VLTChangePermission). The main data
108 structures used for collecting the class hierarchy data and
109 building/maintaining the vtable map variable data are defined in
110 gcc/vtable-verify.h, because they are used both here and in
111 gcc/vtable-verify.c. */
115 #include "coretypes.h"
119 #include "tree-iterator.h"
120 #include "vtable-verify.h"
123 static int num_calls_to_regset
= 0;
124 static int num_calls_to_regpair
= 0;
125 static int current_set_size
;
127 /* Mark these specially since they need to be stored in precompiled
129 static GTY (()) vec
<tree
, va_gc
> *vlt_saved_class_info
;
130 static GTY (()) tree vlt_register_pairs_fndecl
= NULL_TREE
;
131 static GTY (()) tree vlt_register_set_fndecl
= NULL_TREE
;
134 struct vtv_graph_node
*node
;
135 struct work_node
*next
;
138 struct vtbl_map_node
*vtable_find_or_create_map_decl (tree
);
140 /* As part of vtable verification the compiler generates and inserts
141 calls to __VLTVerifyVtablePointer, which is in libstdc++. This
142 function builds and initializes the function decl that is used
143 in generating those function calls.
145 In addition to __VLTVerifyVtablePointer there is also
146 __VLTVerifyVtablePointerDebug which can be used in place of
147 __VLTVerifyVtablePointer, and which takes extra parameters and
148 outputs extra information, to help debug problems. The debug
149 version of this function is generated and used if flag_vtv_debug is
152 The signatures for these functions are:
154 void * __VLTVerifyVtablePointer (void **, void*);
155 void * __VLTVerifyVtablePointerDebug (void**, void *, char *, char *);
159 vtv_build_vtable_verify_fndecl (void)
161 tree func_type
= NULL_TREE
;
163 if (verify_vtbl_ptr_fndecl
!= NULL_TREE
164 && TREE_CODE (verify_vtbl_ptr_fndecl
) != ERROR_MARK
)
169 func_type
= build_function_type_list (const_ptr_type_node
,
170 build_pointer_type (ptr_type_node
),
172 const_string_type_node
,
173 const_string_type_node
,
175 verify_vtbl_ptr_fndecl
=
176 build_lang_decl (FUNCTION_DECL
,
177 get_identifier ("__VLTVerifyVtablePointerDebug"),
182 func_type
= build_function_type_list (const_ptr_type_node
,
183 build_pointer_type (ptr_type_node
),
186 verify_vtbl_ptr_fndecl
=
187 build_lang_decl (FUNCTION_DECL
,
188 get_identifier ("__VLTVerifyVtablePointer"),
192 TREE_NOTHROW (verify_vtbl_ptr_fndecl
) = 1;
193 DECL_ATTRIBUTES (verify_vtbl_ptr_fndecl
)
194 = tree_cons (get_identifier ("leaf"), NULL
,
195 DECL_ATTRIBUTES (verify_vtbl_ptr_fndecl
));
196 DECL_PURE_P (verify_vtbl_ptr_fndecl
) = 1;
197 TREE_PUBLIC (verify_vtbl_ptr_fndecl
) = 1;
198 DECL_PRESERVE_P (verify_vtbl_ptr_fndecl
) = 1;
201 /* As part of vtable verification the compiler generates and inserts
202 calls to __VLTRegisterSet and __VLTRegisterPair, which are in
203 libsupc++. This function builds and initializes the function decls
204 that are used in generating those function calls.
206 The signatures for these functions are:
208 void __VLTRegisterSetDebug (void **, const void *, std::size_t,
211 void __VLTRegisterSet (void **, const void *, std::size_t,
214 void __VLTRegisterPairDebug (void **, const void *, size_t,
215 const void *, const char *, const char *);
217 void __VLTRegisterPair (void **, const void *, size_t, const void *);
221 init_functions (void)
223 tree register_set_type
;
224 tree register_pairs_type
;
226 if (vlt_register_set_fndecl
!= NULL_TREE
)
229 gcc_assert (vlt_register_pairs_fndecl
== NULL_TREE
);
230 gcc_assert (vlt_register_set_fndecl
== NULL_TREE
);
232 /* Build function decl for __VLTRegisterSet*. */
234 register_set_type
= build_function_type_list
236 build_pointer_type (ptr_type_node
),
240 build_pointer_type (ptr_type_node
),
244 vlt_register_set_fndecl
= build_lang_decl
246 get_identifier ("__VLTRegisterSetDebug"),
249 vlt_register_set_fndecl
= build_lang_decl
251 get_identifier ("__VLTRegisterSet"),
255 TREE_NOTHROW (vlt_register_set_fndecl
) = 1;
256 DECL_ATTRIBUTES (vlt_register_set_fndecl
) =
257 tree_cons (get_identifier ("leaf"), NULL
,
258 DECL_ATTRIBUTES (vlt_register_set_fndecl
));
259 TREE_PUBLIC (vlt_register_set_fndecl
) = 1;
260 DECL_PRESERVE_P (vlt_register_set_fndecl
) = 1;
261 SET_DECL_LANGUAGE (vlt_register_set_fndecl
, lang_cplusplus
);
263 /* Build function decl for __VLTRegisterPair*. */
267 register_pairs_type
= build_function_type_list (void_type_node
,
273 const_string_type_node
,
274 const_string_type_node
,
277 vlt_register_pairs_fndecl
= build_lang_decl
279 get_identifier ("__VLTRegisterPairDebug"),
280 register_pairs_type
);
284 register_pairs_type
= build_function_type_list (void_type_node
,
292 vlt_register_pairs_fndecl
= build_lang_decl
294 get_identifier ("__VLTRegisterPair"),
295 register_pairs_type
);
298 TREE_NOTHROW (vlt_register_pairs_fndecl
) = 1;
299 DECL_ATTRIBUTES (vlt_register_pairs_fndecl
) =
300 tree_cons (get_identifier ("leaf"), NULL
,
301 DECL_ATTRIBUTES (vlt_register_pairs_fndecl
));
302 TREE_PUBLIC (vlt_register_pairs_fndecl
) = 1;
303 DECL_PRESERVE_P (vlt_register_pairs_fndecl
) = 1;
304 SET_DECL_LANGUAGE (vlt_register_pairs_fndecl
, lang_cplusplus
);
308 /* This is a helper function for
309 vtv_compute_class_hierarchy_transitive_closure. It adds a
310 vtv_graph_node to the WORKLIST, which is a linked list of
311 seen-but-not-yet-processed nodes. INSERTED is a bitmap, one bit
312 per node, to help make sure that we don't insert a node into the
313 worklist more than once. Each node represents a class somewhere in
314 our class hierarchy information. Every node in the graph gets added
315 to the worklist exactly once and removed from the worklist exactly
316 once (when all of its children have been processed). */
319 add_to_worklist (struct work_node
**worklist
, struct vtv_graph_node
*node
,
322 struct work_node
*new_work_node
;
324 if (bitmap_bit_p (inserted
, node
->class_uid
))
327 new_work_node
= XNEW (struct work_node
);
328 new_work_node
->next
= *worklist
;
329 new_work_node
->node
= node
;
330 *worklist
= new_work_node
;
332 bitmap_set_bit (inserted
, node
->class_uid
);
335 /* This is a helper function for
336 vtv_compute_class_hierarchy_transitive_closure. It goes through
337 the WORKLIST of class hierarchy nodes looking for a "leaf" node,
338 i.e. a node whose children in the hierarchy have all been
339 processed. When it finds the next leaf node, it removes it from
340 the linked list (WORKLIST) and returns the node. */
342 static struct vtv_graph_node
*
343 find_and_remove_next_leaf_node (struct work_node
**worklist
)
345 struct work_node
*prev
, *cur
;
346 struct vtv_graph_node
*ret_val
= NULL
;
348 for (prev
= NULL
, cur
= *worklist
; cur
; prev
= cur
, cur
= cur
->next
)
350 if ((cur
->node
->children
).length() == cur
->node
->num_processed_children
)
353 (*worklist
) = cur
->next
;
355 prev
->next
= cur
->next
;
367 /* In our class hierarchy graph, each class node contains a bitmap,
368 with one bit for each class in the hierarchy. The bits are set for
369 classes that are descendants in the graph of the current node.
370 Initially the descendants bitmap is only set for immediate
371 descendants. This function traverses the class hierarchy graph,
372 bottom up, filling in the transitive closures for the descendants
373 as we rise up the graph. */
376 vtv_compute_class_hierarchy_transitive_closure (void)
378 struct work_node
*worklist
= NULL
;
379 sbitmap inserted
= sbitmap_alloc (num_vtable_map_nodes
);
383 /* Note: Every node in the graph gets added to the worklist exactly
384 once and removed from the worklist exactly once (when all of its
385 children have been processed). Each node's children edges are
386 followed exactly once, and each node's parent edges are followed
387 exactly once. So this algorithm is roughly O(V + 2E), i.e.
391 /* Find all the "leaf" nodes in the graph, and add them to the worklist. */
392 bitmap_clear (inserted
);
393 for (j
= 0; j
< num_vtable_map_nodes
; ++j
)
395 struct vtbl_map_node
*cur
= vtbl_map_nodes_vec
[j
];
397 && ((cur
->class_info
->children
).length() == 0)
398 && ! (bitmap_bit_p (inserted
, cur
->class_info
->class_uid
)))
399 add_to_worklist (&worklist
, cur
->class_info
, inserted
);
402 /* Main work: pull next leaf node off work list, process it, add its
403 parents to the worklist, where a 'leaf' node is one that has no
404 children, or all of its children have been processed. */
407 struct vtv_graph_node
*temp_node
=
408 find_and_remove_next_leaf_node (&worklist
);
410 gcc_assert (temp_node
!= NULL
);
411 temp_node
->descendants
= sbitmap_alloc (num_vtable_map_nodes
);
412 bitmap_clear (temp_node
->descendants
);
413 bitmap_set_bit (temp_node
->descendants
, temp_node
->class_uid
);
414 for (i
= 0; i
< (temp_node
->children
).length(); ++i
)
415 bitmap_ior (temp_node
->descendants
, temp_node
->descendants
,
416 temp_node
->children
[i
]->descendants
);
417 for (i
= 0; i
< (temp_node
->parents
).length(); ++i
)
419 temp_node
->parents
[i
]->num_processed_children
=
420 temp_node
->parents
[i
]->num_processed_children
+ 1;
421 if (!bitmap_bit_p (inserted
, temp_node
->parents
[i
]->class_uid
))
422 add_to_worklist (&worklist
, temp_node
->parents
[i
], inserted
);
427 /* Keep track of which pairs we have already created __VLTRegisterPair
428 calls for, to prevent creating duplicate calls within the same
429 compilation unit. VTABLE_DECL is the var decl for the vtable of
430 the (descendant) class that we are adding to our class hierarchy
431 data. VPTR_ADDRESS is an expression for calculating the correct
432 offset into the vtable (VTABLE_DECL). It is the actual vtable
433 pointer address that will be stored in our list of valid vtable
434 pointers for BASE_CLASS. BASE_CLASS is the record_type node for
435 the base class to whose hiearchy we want to add
436 VPTR_ADDRESS. (VTABLE_DECL should be the vtable for BASE_CLASS or
437 one of BASE_CLASS' descendents. */
440 check_and_record_registered_pairs (tree vtable_decl
, tree vptr_address
,
444 struct vtbl_map_node
*base_vtable_map_node
;
445 bool inserted_something
= false;
448 if (TREE_CODE (vptr_address
) == ADDR_EXPR
449 && TREE_CODE (TREE_OPERAND (vptr_address
, 0)) == MEM_REF
)
450 vptr_address
= TREE_OPERAND (vptr_address
, 0);
452 if (TREE_OPERAND_LENGTH (vptr_address
) > 1)
453 offset
= tree_to_uhwi (TREE_OPERAND (vptr_address
, 1));
457 base_vtable_map_node
= vtbl_map_get_node (TYPE_MAIN_VARIANT (base_class
));
459 inserted_something
= vtbl_map_node_registration_insert
460 (base_vtable_map_node
,
463 return !inserted_something
;
466 /* Given an IDENTIFIER_NODE, build and return a string literal based on it. */
469 build_string_from_id (tree identifier
)
473 gcc_assert (TREE_CODE (identifier
) == IDENTIFIER_NODE
);
475 len
= IDENTIFIER_LENGTH (identifier
);
476 return build_string_literal (len
+ 1, IDENTIFIER_POINTER (identifier
));
479 /* A class may contain secondary vtables in it, for various reasons.
480 This function goes through the decl chain of a class record looking
481 for any fields that point to secondary vtables, and adding calls to
482 __VLTRegisterPair for the secondary vtable pointers.
484 BASE_CLASS_DECL_ARG is an expression for the address of the vtable
485 map variable for the BASE_CLASS (whose hierarchy we are currently
486 updating). BASE_CLASS is the record_type node for the base class.
487 RECORD_TYPE is the record_type node for the descendant class that
488 we are possibly adding to BASE_CLASS's hierarchy. BODY is the
489 function body for the constructor init function to which we are
490 adding our calls to __VLTRegisterPair. */
493 register_construction_vtables (tree base_class
, tree record_type
,
494 vec
<tree
> *vtable_ptr_array
)
498 if (TREE_CODE (record_type
) != RECORD_TYPE
)
501 vtbl_var_decl
= CLASSTYPE_VTABLES (record_type
);
503 if (CLASSTYPE_VBASECLASSES (record_type
))
506 bool already_registered
= false;
507 tree val_vtbl_decl
= NULL_TREE
;
509 vtt_decl
= DECL_CHAIN (vtbl_var_decl
);
511 /* Check to see if we have found a VTT. Add its data if appropriate. */
514 tree values
= DECL_INITIAL (vtt_decl
);
515 if (TREE_ASM_WRITTEN (vtt_decl
)
516 && values
!= NULL_TREE
517 && TREE_CODE (values
) == CONSTRUCTOR
518 && TREE_CODE (TREE_TYPE (values
)) == ARRAY_TYPE
)
520 unsigned HOST_WIDE_INT cnt
;
523 /* Loop through the initialization values for this
524 vtable to get all the correct vtable pointer
525 addresses that we need to add to our set of valid
526 vtable pointers for the current base class. This may
527 result in adding more than just the element assigned
528 to the primary vptr of the class, so we may end up
529 with more vtable pointers than are strictly
533 vec_safe_iterate (CONSTRUCTOR_ELTS (values
),
537 tree value
= ce
->value
;
539 /* Search for the ADDR_EXPR operand within the value. */
542 && TREE_OPERAND (value
, 0)
543 && TREE_CODE (TREE_OPERAND (value
, 0)) == ADDR_EXPR
)
544 value
= TREE_OPERAND (value
, 0);
546 /* The VAR_DECL for the vtable should be the first
547 argument of the ADDR_EXPR, which is the first
550 if (TREE_OPERAND (value
, 0))
551 val_vtbl_decl
= TREE_OPERAND (value
, 0);
553 while (TREE_CODE (val_vtbl_decl
) != VAR_DECL
554 && TREE_OPERAND (val_vtbl_decl
, 0))
555 val_vtbl_decl
= TREE_OPERAND (val_vtbl_decl
, 0);
557 gcc_assert (TREE_CODE (val_vtbl_decl
) == VAR_DECL
);
559 /* Check to see if we already have this vtable pointer in
560 our valid set for this base class. */
562 already_registered
= check_and_record_registered_pairs
567 if (already_registered
)
570 /* Add this vtable pointer to our set of valid
571 pointers for the base class. */
573 vtable_ptr_array
->safe_push (value
);
581 /* This function iterates through all the vtables it can find from the
582 BINFO of a class, to make sure we have found ALL of the vtables
583 that an object of that class could point to. Generate calls to
584 __VLTRegisterPair for those vtable pointers that we find.
586 BINFO is the tree_binfo node for the BASE_CLASS. BODY is the
587 function body for the constructor init function to which we are
588 adding calls to __VLTRegisterPair. ARG1 is an expression for the
589 address of the vtable map variable (for the BASE_CLASS), that will
590 point to the updated data set. BASE_CLASS is the record_type node
591 for the base class whose set of valid vtable pointers we are
592 updating. STR1 and STR2 are all debugging information, to be passed
593 as parameters to __VLTRegisterPairDebug. STR1 represents the name
594 of the vtable map variable to be updated by the call. Similarly,
595 STR2 represents the name of the class whose vtable pointer is being
596 added to the hierarchy. */
599 register_other_binfo_vtables (tree binfo
, tree base_class
,
600 vec
<tree
> *vtable_ptr_array
)
605 bool already_registered
;
607 if (binfo
== NULL_TREE
)
610 for (ix
= 0; BINFO_BASE_ITERATE (binfo
, ix
, base_binfo
); ix
++)
612 if ((!BINFO_PRIMARY_P (base_binfo
)
613 || BINFO_VIRTUAL_P (base_binfo
))
614 && (vtable_decl
= get_vtbl_decl_for_binfo (base_binfo
)))
616 tree vtable_address
= build_vtbl_address (base_binfo
);
618 already_registered
= check_and_record_registered_pairs
622 if (!already_registered
)
624 vtable_ptr_array
->safe_push (vtable_address
);
629 register_other_binfo_vtables (base_binfo
, base_class
, vtable_ptr_array
);
633 /* The set of valid vtable pointers for any given class are stored in
634 a hash table. For reasons of efficiency, that hash table size is
635 always a power of two. In order to try to prevent re-sizing the
636 hash tables very often, we pass __VLTRegisterPair an initial guess
637 as to the number of entries the hashtable will eventually need
638 (rounded up to the nearest power of two). This function takes the
639 class information we have collected for a particular class,
640 CLASS_NODE, and calculates the hash table size guess. */
643 guess_num_vtable_pointers (struct vtv_graph_node
*class_node
)
646 int total_num_vtbls
= 0;
647 int num_vtbls_power_of_two
= 1;
650 for (i
= 0; i
< num_vtable_map_nodes
; ++i
)
651 if (bitmap_bit_p (class_node
->descendants
, i
))
653 tree class_type
= vtbl_map_nodes_vec
[i
]->class_info
->class_type
;
654 for (vtbl
= CLASSTYPE_VTABLES (class_type
); vtbl
;
655 vtbl
= DECL_CHAIN (vtbl
))
658 if (total_num_vtbls
> num_vtbls_power_of_two
)
659 num_vtbls_power_of_two
<<= 1;
662 return num_vtbls_power_of_two
;
665 /* A simple hash function on strings */
666 /* Be careful about changing this routine. The values generated will
667 be stored in the calls to InitSet. So, changing this routine may
668 cause a binary incompatibility. */
671 vtv_string_hash (const char *in
)
676 gcc_assert (in
!= NULL
);
683 get_log_file_name (const char *fname
)
685 const char *tmp_dir
= concat (dump_dir_name
, NULL
);
690 dir_len
= strlen (tmp_dir
);
691 fname_len
= strlen (fname
);
693 full_name
= XNEWVEC (char, dir_len
+ fname_len
+ 1);
694 strcpy (full_name
, tmp_dir
);
695 strcpy (full_name
+ dir_len
, fname
);
701 write_out_current_set_data (tree base_class
, int set_size
)
703 static int class_data_log_fd
= -1;
705 int bytes_written
__attribute__ ((unused
));
706 char *file_name
= get_log_file_name ("vtv_class_set_sizes.log");
708 if (class_data_log_fd
== -1)
709 class_data_log_fd
= open (file_name
,
710 O_WRONLY
| O_APPEND
| O_CREAT
, S_IRWXU
);
712 if (class_data_log_fd
== -1)
714 warning_at (UNKNOWN_LOCATION
, 0,
715 "unable to open log file %<vtv_class_set_sizes.log%>: %m");
719 snprintf (buffer
, sizeof (buffer
), "%s %d\n",
720 IDENTIFIER_POINTER (DECL_ASSEMBLER_NAME (TYPE_NAME (base_class
))),
722 bytes_written
= write (class_data_log_fd
, buffer
, strlen (buffer
));
726 build_key_buffer_arg (tree base_ptr_var_decl
)
728 const int key_type_fixed_size
= 8;
729 uint32_t len1
= IDENTIFIER_LENGTH (DECL_NAME (base_ptr_var_decl
));
730 uint32_t hash_value
= vtv_string_hash (IDENTIFIER_POINTER
731 (DECL_NAME (base_ptr_var_decl
)));
732 void *key_buffer
= xmalloc (len1
+ key_type_fixed_size
);
733 uint32_t *value_ptr
= (uint32_t *) key_buffer
;
736 /* Set the len and hash for the string. */
739 *value_ptr
= hash_value
;
741 /* Now copy the string representation of the vtbl map name... */
742 memcpy ((char *) key_buffer
+ key_type_fixed_size
,
743 IDENTIFIER_POINTER (DECL_NAME (base_ptr_var_decl
)),
746 /* ... and build a string literal from it. This will make a copy
747 so the key_bufffer is not needed anymore after this. */
748 ret_value
= build_string_literal (len1
+ key_type_fixed_size
,
749 (char *) key_buffer
);
755 insert_call_to_register_set (tree class_name
,
756 vec
<tree
> *vtbl_ptr_array
, tree body
, tree arg1
,
757 tree arg2
, tree size_hint_arg
)
760 int num_args
= vtbl_ptr_array
->length();
761 char *array_arg_name
= ACONCAT (("__vptr_array_",
762 IDENTIFIER_POINTER (class_name
), NULL
));
763 tree array_arg_type
= build_array_type_nelts (build_pointer_type
767 tree array_arg
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
,
768 get_identifier (array_arg_name
),
772 vec
<constructor_elt
, va_gc
> *array_elements
;
773 vec_alloc (array_elements
, num_args
);
775 tree initial
= NULL_TREE
;
776 tree arg3
= NULL_TREE
;
778 TREE_PUBLIC (array_arg
) = 0;
779 DECL_EXTERNAL (array_arg
) = 0;
780 TREE_STATIC (array_arg
) = 1;
781 DECL_ARTIFICIAL (array_arg
) = 0;
782 TREE_READONLY (array_arg
) = 1;
783 DECL_IGNORED_P (array_arg
) = 0;
784 DECL_PRESERVE_P (array_arg
) = 0;
785 DECL_VISIBILITY (array_arg
) = VISIBILITY_HIDDEN
;
787 for (k
= 0; k
< num_args
; ++k
)
789 CONSTRUCTOR_APPEND_ELT (array_elements
, NULL_TREE
, (*vtbl_ptr_array
)[k
]);
792 initial
= build_constructor (TREE_TYPE (array_arg
), array_elements
);
794 TREE_CONSTANT (initial
) = 1;
795 TREE_STATIC (initial
) = 1;
796 DECL_INITIAL (array_arg
) = initial
;
797 relayout_decl (array_arg
);
798 varpool_finalize_decl (array_arg
);
800 arg3
= build1 (ADDR_EXPR
, TYPE_POINTER_TO (TREE_TYPE (array_arg
)), array_arg
);
802 TREE_TYPE (arg3
) = build_pointer_type (TREE_TYPE (array_arg
));
804 call_expr
= build_call_expr (vlt_register_set_fndecl
, 5, arg1
,
805 arg2
, /* set_symbol_key */
806 size_hint_arg
, build_int_cst (size_type_node
,
809 append_to_statement_list (call_expr
, &body
);
810 num_calls_to_regset
++;
814 insert_call_to_register_pair (vec
<tree
> *vtbl_ptr_array
, tree arg1
,
815 tree arg2
, tree size_hint_arg
, tree str1
,
816 tree str2
, tree body
)
819 int num_args
= vtbl_ptr_array
->length();
820 tree vtable_address
= NULL_TREE
;
823 vtable_address
= build_int_cst (build_pointer_type (void_type_node
), 0);
825 vtable_address
= (*vtbl_ptr_array
)[0];
828 call_expr
= build_call_expr (vlt_register_pairs_fndecl
, 6, arg1
, arg2
,
829 size_hint_arg
, vtable_address
, str1
, str2
);
831 call_expr
= build_call_expr (vlt_register_pairs_fndecl
, 4, arg1
, arg2
,
832 size_hint_arg
, vtable_address
);
834 append_to_statement_list (call_expr
, &body
);
835 num_calls_to_regpair
++;
839 output_set_info (tree record_type
, vec
<tree
> vtbl_ptr_array
)
841 static int vtv_debug_log_fd
= -1;
843 int bytes_written
__attribute__ ((unused
));
844 int array_len
= vtbl_ptr_array
.length();
845 const char *class_name
=
846 IDENTIFIER_POINTER (DECL_ASSEMBLER_NAME (TYPE_NAME (record_type
)));
847 char *file_name
= get_log_file_name ("vtv_set_ptr_data.log");
849 if (vtv_debug_log_fd
== -1)
850 vtv_debug_log_fd
= open (file_name
,
851 O_WRONLY
| O_APPEND
| O_CREAT
, S_IRWXU
);
852 if (vtv_debug_log_fd
== -1)
854 warning_at (UNKNOWN_LOCATION
, 0,
855 "unable to open log file %<vtv_set_ptr_data.log%>: %m");
859 for (int i
= 0; i
< array_len
; ++i
)
861 const char *vptr_name
= "unknown";
864 if (TREE_CODE (vtbl_ptr_array
[i
]) == POINTER_PLUS_EXPR
)
866 tree arg0
= TREE_OPERAND (vtbl_ptr_array
[i
], 0);
867 tree arg1
= TREE_OPERAND (vtbl_ptr_array
[i
], 1);
869 if (TREE_CODE (arg0
) == ADDR_EXPR
)
870 arg0
= TREE_OPERAND (arg0
, 0);
872 if (TREE_CODE (arg0
) == VAR_DECL
)
873 vptr_name
= IDENTIFIER_POINTER (DECL_NAME (arg0
));
875 if (TREE_CODE (arg1
) == INTEGER_CST
)
876 vptr_offset
= tree_to_uhwi (arg1
);
879 snprintf (buffer
, sizeof (buffer
), "%s %s %s + %d\n",
880 main_input_filename
, class_name
, vptr_name
, vptr_offset
);
881 bytes_written
= write (vtv_debug_log_fd
, buffer
, strlen(buffer
));
886 /* This function goes through our internal class hierarchy & vtable
887 pointer data structure and outputs calls to __VLTRegisterPair for
888 every class-vptr pair (for those classes whose vtable would be
889 output in the current compilation unit). These calls get put into
890 our constructor initialization function. BODY is the function
891 body, so far, of our constructor initialization function, to which we
895 register_all_pairs (tree body
)
897 bool registered_at_least_one
= false;
898 vec
<tree
> *vtbl_ptr_array
= NULL
;
901 for (j
= 0; j
< num_vtable_map_nodes
; ++j
)
903 struct vtbl_map_node
*current
= vtbl_map_nodes_vec
[j
];
905 tree base_class
= current
->class_info
->class_type
;
906 tree base_ptr_var_decl
= current
->vtbl_map_decl
;
910 tree str1
= NULL_TREE
;
911 tree str2
= NULL_TREE
;
915 gcc_assert (current
->class_info
!= NULL
);
919 str1
= build_string_from_id (DECL_NAME (base_ptr_var_decl
));
921 new_type
= build_pointer_type (TREE_TYPE (base_ptr_var_decl
));
922 arg1
= build1 (ADDR_EXPR
, new_type
, base_ptr_var_decl
);
924 /* We need a fresh vector for each iteration. */
926 vec_free (vtbl_ptr_array
);
928 vec_alloc (vtbl_ptr_array
, 10);
930 for (i
= 0; i
< num_vtable_map_nodes
; ++i
)
931 if (bitmap_bit_p (current
->class_info
->descendants
, i
))
933 struct vtbl_map_node
*vtbl_class_node
= vtbl_map_nodes_vec
[i
];
934 tree class_type
= vtbl_class_node
->class_info
->class_type
;
937 && (TREE_CODE (class_type
) == RECORD_TYPE
))
939 bool already_registered
;
941 tree binfo
= TYPE_BINFO (class_type
);
943 bool vtable_should_be_output
= false;
945 vtable_decl
= CLASSTYPE_VTABLES (class_type
);
947 /* Handle main vtable for this class. */
951 vtable_should_be_output
= TREE_ASM_WRITTEN (vtable_decl
);
952 str2
= build_string_from_id (DECL_NAME (vtable_decl
));
955 if (vtable_decl
&& vtable_should_be_output
)
957 tree vtable_address
= build_vtbl_address (binfo
);
959 already_registered
= check_and_record_registered_pairs
965 if (!already_registered
)
967 vtbl_ptr_array
->safe_push (vtable_address
);
969 /* Find and handle any 'extra' vtables associated
970 with this class, via virtual inheritance. */
971 register_construction_vtables (base_class
, class_type
,
974 /* Find and handle any 'extra' vtables associated
975 with this class, via multiple inheritance. */
976 register_other_binfo_vtables (binfo
, base_class
,
982 current_set_size
= vtbl_ptr_array
->length();
984 /* Sometimes we need to initialize the set symbol even if we are
985 not adding any vtable pointers to the set in the current
986 compilation unit. In that case, we need to initialize the
987 set to our best guess as to what the eventual size of the set
988 hash table will be (to prevent having to re-size the hash
991 size_hint
= guess_num_vtable_pointers (current
->class_info
);
993 /* If we have added vtable pointers to the set in this
994 compilation unit, adjust the size hint for the set's hash
995 table appropriately. */
996 if (vtbl_ptr_array
->length() > 0)
998 unsigned len
= vtbl_ptr_array
->length();
999 while ((size_t) len
> size_hint
)
1002 size_hint_arg
= build_int_cst (size_type_node
, size_hint
);
1004 /* Get the key-buffer argument. */
1005 arg2
= build_key_buffer_arg (base_ptr_var_decl
);
1007 if (str2
== NULL_TREE
)
1008 str2
= build_string_literal (strlen ("unknown") + 1,
1012 output_set_info (current
->class_info
->class_type
,
1015 if (vtbl_ptr_array
->length() > 1)
1017 insert_call_to_register_set (current
->class_name
,
1018 vtbl_ptr_array
, body
, arg1
, arg2
,
1020 registered_at_least_one
= true;
1025 if (vtbl_ptr_array
->length() > 0
1026 || (current
->is_used
1027 || (current
->registered
.size() > 0)))
1029 insert_call_to_register_pair (vtbl_ptr_array
,
1030 arg1
, arg2
, size_hint_arg
, str1
,
1032 registered_at_least_one
= true;
1036 if (flag_vtv_counts
&& current_set_size
> 0)
1037 write_out_current_set_data (base_class
, current_set_size
);
1041 return registered_at_least_one
;
1044 /* Given a tree containing a class type (CLASS_TYPE), this function
1045 finds and returns the class hierarchy node for that class in our
1048 static struct vtv_graph_node
*
1049 find_graph_node (tree class_type
)
1051 struct vtbl_map_node
*vtbl_node
;
1053 vtbl_node
= vtbl_map_get_node (TYPE_MAIN_VARIANT (class_type
));
1055 return vtbl_node
->class_info
;
1060 /* Add base class/derived class pair to our internal class hierarchy
1061 data structure. BASE_NODE is our vtv_graph_node that corresponds
1062 to a base class. DERIVED_NODE is our vtv_graph_node that
1063 corresponds to a class that is a descendant of the base class
1064 (possibly the base class itself). */
1067 add_hierarchy_pair (struct vtv_graph_node
*base_node
,
1068 struct vtv_graph_node
*derived_node
)
1070 (base_node
->children
).safe_push (derived_node
);
1071 (derived_node
->parents
).safe_push (base_node
);
1074 /* This functions adds a new base class/derived class relationship to
1075 our class hierarchy data structure. Both parameters are trees
1076 representing the class types, i.e. RECORD_TYPE trees.
1077 DERIVED_CLASS can be the same as BASE_CLASS. */
1080 update_class_hierarchy_information (tree base_class
,
1083 struct vtv_graph_node
*base_node
= find_graph_node (base_class
);
1084 struct vtv_graph_node
*derived_node
= find_graph_node (derived_class
);
1086 add_hierarchy_pair (base_node
, derived_node
);
1091 write_out_vtv_count_data (void)
1093 static int vtv_count_log_fd
= -1;
1095 int unused_vtbl_map_vars
= 0;
1096 int bytes_written
__attribute__ ((unused
));
1097 char *file_name
= get_log_file_name ("vtv_count_data.log");
1099 if (vtv_count_log_fd
== -1)
1100 vtv_count_log_fd
= open (file_name
,
1101 O_WRONLY
| O_APPEND
| O_CREAT
, S_IRWXU
);
1102 if (vtv_count_log_fd
== -1)
1104 warning_at (UNKNOWN_LOCATION
, 0,
1105 "unable to open log file %<vtv_count_data.log%>: %m");
1109 for (unsigned i
= 0; i
< num_vtable_map_nodes
; ++i
)
1111 struct vtbl_map_node
*current
= vtbl_map_nodes_vec
[i
];
1112 if (!current
->is_used
1113 && current
->registered
.size() == 0)
1114 unused_vtbl_map_vars
++;
1117 snprintf (buffer
, sizeof (buffer
), "%s %d %d %d %d %d\n",
1118 main_input_filename
, total_num_virtual_calls
,
1119 total_num_verified_vcalls
, num_calls_to_regset
,
1120 num_calls_to_regpair
, unused_vtbl_map_vars
);
1122 bytes_written
= write (vtv_count_log_fd
, buffer
, strlen (buffer
));
1125 /* This function calls register_all_pairs, which actually generates
1126 all the calls to __VLTRegisterPair (in the verification constructor
1127 init function). It also generates the calls to
1128 __VLTChangePermission, if the verification constructor init
1129 function is going into the preinit array. INIT_ROUTINE_BODY is
1130 the body of our constructior initialization function, to which we
1131 add our function calls.*/
1134 vtv_register_class_hierarchy_information (tree init_routine_body
)
1136 bool registered_something
= false;
1140 if (num_vtable_map_nodes
== 0)
1143 /* Add class hierarchy pairs to the vtable map data structure. */
1144 registered_something
= register_all_pairs (init_routine_body
);
1146 if (flag_vtv_counts
)
1147 write_out_vtv_count_data ();
1149 return registered_something
;
1153 /* Generate the special constructor function that calls
1154 __VLTChangePermission and __VLTRegisterPairs, and give it a very
1155 high initialization priority. */
1158 vtv_generate_init_routine (void)
1160 tree init_routine_body
;
1161 bool vtable_classes_found
= false;
1163 push_lang_context (lang_name_c
);
1165 /* The priority for this init function (constructor) is carefully
1166 chosen so that it will happen after the calls to unprotect the
1167 memory used for vtable verification and before the memory is
1169 init_routine_body
= vtv_start_verification_constructor_init_function ();
1171 vtable_classes_found
=
1172 vtv_register_class_hierarchy_information (init_routine_body
);
1174 if (vtable_classes_found
)
1177 vtv_finish_verification_constructor_init_function (init_routine_body
);
1178 TREE_STATIC (vtv_fndecl
) = 1;
1179 TREE_USED (vtv_fndecl
) = 1;
1180 DECL_PRESERVE_P (vtv_fndecl
) = 1;
1181 if (flag_vtable_verify
== VTV_PREINIT_PRIORITY
)
1182 DECL_STATIC_CONSTRUCTOR (vtv_fndecl
) = 0;
1184 gimplify_function_tree (vtv_fndecl
);
1185 cgraph_add_new_function (vtv_fndecl
, false);
1187 cgraph_process_new_functions ();
1189 if (flag_vtable_verify
== VTV_PREINIT_PRIORITY
)
1190 assemble_vtv_preinit_initializer (vtv_fndecl
);
1193 pop_lang_context ();
1196 /* This funtion takes a tree containing a class type (BASE_TYPE), and
1197 it either finds the existing vtbl_map_node for that class in our
1198 data structure, or it creates a new node and adds it to the data
1199 structure if there is not one for the class already. As part of
1200 this process it also creates the global vtable map variable for the
1203 struct vtbl_map_node
*
1204 vtable_find_or_create_map_decl (tree base_type
)
1206 char *var_name
= NULL
;
1207 struct vtbl_map_node
*vtable_map_node
= NULL
;
1209 /* Verify the type has an associated vtable. */
1210 if (!TYPE_BINFO (base_type
) || !BINFO_VTABLE (TYPE_BINFO (base_type
)))
1213 /* Create map lookup symbol for base class */
1214 var_name
= get_mangled_vtable_map_var_name (base_type
);
1216 /* We've already created the variable; just look it. */
1217 vtable_map_node
= vtbl_map_get_node (TYPE_MAIN_VARIANT (base_type
));
1219 if (!vtable_map_node
|| (vtable_map_node
->vtbl_map_decl
== NULL_TREE
))
1221 /* If we haven't already created the *__vtable_map global
1222 variable for this class, do so now, and add it to the
1223 varpool, to make sure it gets saved and written out. */
1225 tree var_decl
= NULL
;
1226 tree var_type
= build_pointer_type (void_type_node
);
1227 tree initial_value
= integer_zero_node
;
1229 var_decl
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
,
1230 get_identifier (var_name
), var_type
);
1232 DECL_EXTERNAL (var_decl
) = 0;
1233 TREE_STATIC (var_decl
) = 1;
1234 DECL_VISIBILITY (var_decl
) = VISIBILITY_HIDDEN
;
1235 SET_DECL_ASSEMBLER_NAME (var_decl
, get_identifier (var_name
));
1236 DECL_ARTIFICIAL (var_decl
) = 1;
1237 /* We cannot mark this variable as read-only because we want to be
1238 able to write to it at runtime. */
1239 TREE_READONLY (var_decl
) = 0;
1240 DECL_IGNORED_P (var_decl
) = 1;
1241 DECL_PRESERVE_P (var_decl
) = 1;
1243 /* Put these mmap variables in thr .vtable_map_vars section, so
1244 we can find and protect them. */
1246 DECL_SECTION_NAME (var_decl
) = build_string (strlen (".vtable_map_vars"),
1247 ".vtable_map_vars");
1248 DECL_HAS_IMPLICIT_SECTION_NAME_P (var_decl
) = true;
1249 DECL_INITIAL (var_decl
) = initial_value
;
1251 comdat_linkage (var_decl
);
1253 varpool_finalize_decl (var_decl
);
1254 if (!vtable_map_node
)
1256 find_or_create_vtbl_map_node (TYPE_MAIN_VARIANT (base_type
));
1257 if (vtable_map_node
->vtbl_map_decl
== NULL_TREE
)
1258 vtable_map_node
->vtbl_map_decl
= var_decl
;
1261 gcc_assert (vtable_map_node
);
1262 return vtable_map_node
;
1265 /* This function is used to build up our class hierarchy data for a
1266 particular class. TYPE is the record_type tree node for the
1270 vtv_insert_single_class_info (tree type
)
1272 if (flag_vtable_verify
)
1274 tree binfo
= TYPE_BINFO (type
);
1276 struct vtbl_map_node
*own_map
;
1279 /* First make sure to create the map for this record type. */
1280 own_map
= vtable_find_or_create_map_decl (type
);
1281 if (own_map
== NULL
)
1284 /* Go through the list of all base classes for the current
1285 (derived) type, make sure the *__vtable_map global variable
1286 for the base class exists, and add the base class/derived
1287 class pair to the class hierarchy information we are
1288 accumulating (for vtable pointer verification). */
1289 for (i
= 0; BINFO_BASE_ITERATE (binfo
, i
, base_binfo
); i
++)
1291 tree tree_val
= BINFO_TYPE (base_binfo
);
1292 struct vtbl_map_node
*vtable_map_node
= NULL
;
1294 vtable_map_node
= vtable_find_or_create_map_decl (tree_val
);
1296 if (vtable_map_node
!= NULL
)
1297 update_class_hierarchy_information (tree_val
, type
);
1302 /* This function adds classes we are interested in to a list of
1303 classes. RECORD is the record_type node for the class we are
1304 adding to the list. */
1307 vtv_save_class_info (tree record
)
1309 if (!flag_vtable_verify
|| TREE_CODE (record
) == UNION_TYPE
)
1312 if (!vlt_saved_class_info
)
1313 vec_alloc (vlt_saved_class_info
, 10);
1315 gcc_assert (TREE_CODE (record
) == RECORD_TYPE
);
1317 vec_safe_push (vlt_saved_class_info
, record
);
1321 /* This function goes through the list of classes we saved and calls
1322 vtv_insert_single_class_info on each one, to build up our class
1323 hierarchy data structure. */
1326 vtv_recover_class_info (void)
1331 if (vlt_saved_class_info
)
1333 for (i
= 0; i
< vlt_saved_class_info
->length(); ++i
)
1335 current_class
= (*vlt_saved_class_info
)[i
];
1336 gcc_assert (TREE_CODE (current_class
) == RECORD_TYPE
);
1337 vtv_insert_single_class_info (current_class
);
1342 #include "gt-cp-vtable-class-hierarchy.h"