DBGFR3Flow.cpp@ 64586

Last change on this file since 64586 was 64586, checked in by vboxsync, 8 years ago
DBGFR3Flow: Started working on resolving indirect branches. Compilers tend to create a branch table for large switch() {} statements to avoid loads of conditional branches
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 73.5 KB

Line
1	/* $Id: DBGFR3Flow.cpp 64586 2016-11-06 13:56:36Z vboxsync $ */
2	/** @file
3	* DBGF - Debugger Facility, Control Flow Graph Interface (CFG).
4	*/
5
6	/*
7	* Copyright (C) 2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*/
17
18
19	/** @page pg_dbgf_cfg DBGFR3Flow - Control Flow Graph Interface
20	*
21	* The control flow graph interface provides an API to disassemble
22	* guest code providing the result in a control flow graph.
23	*/
24
25
26	/*********************************************************************************************************************************
27	* Header Files *
28	*********************************************************************************************************************************/
29	#define LOG_GROUP LOG_GROUP_DBGF
30	#include <VBox/vmm/dbgf.h>
31	#include "DBGFInternal.h"
32	#include <VBox/vmm/mm.h>
33	#include <VBox/vmm/uvm.h>
34	#include <VBox/vmm/vm.h>
35	#include <VBox/err.h>
36	#include <VBox/log.h>
37
38	#include <iprt/assert.h>
39	#include <iprt/thread.h>
40	#include <iprt/param.h>
41	#include <iprt/list.h>
42	#include <iprt/mem.h>
43	#include <iprt/sort.h>
44	#include <iprt/strcache.h>
45
46	/*********************************************************************************************************************************
47	* Defined Constants And Macros *
48	*********************************************************************************************************************************/
49
50
51
52	/*********************************************************************************************************************************
53	* Structures and Typedefs *
54	*********************************************************************************************************************************/
55
56	/**
57	* Internal control flow graph state.
58	*/
59	typedef struct DBGFFLOWINT
60	{
61	/** Reference counter. */
62	uint32_t volatile cRefs;
63	/** Internal reference counter for basic blocks. */
64	uint32_t volatile cRefsBb;
65	/** Flags during creation. */
66	uint32_t fFlags;
67	/** List of all basic blocks. */
68	RTLISTANCHOR LstFlowBb;
69	/** List of identified branch tables. */
70	RTLISTANCHOR LstBranchTbl;
71	/** Number of basic blocks in this control flow graph. */
72	uint32_t cBbs;
73	/** Number of branch tables in this control flow graph. */
74	uint32_t cBranchTbls;
75	/** The lowest addres of a basic block. */
76	DBGFADDRESS AddrLowest;
77	/** The highest address of a basic block. */
78	DBGFADDRESS AddrHighest;
79	/** String cache for disassembled instructions. */
80	RTSTRCACHE hStrCacheInstr;
81	} DBGFFLOWINT;
82	/** Pointer to an internal control flow graph state. */
83	typedef DBGFFLOWINT *PDBGFFLOWINT;
84
85	/**
86	* Instruction record
87	*/
88	typedef struct DBGFFLOWBBINSTR
89	{
90	/** Instruction address. */
91	DBGFADDRESS AddrInstr;
92	/** Size of instruction. */
93	uint32_t cbInstr;
94	/** Disassembled instruction string. */
95	const char *pszInstr;
96	} DBGFFLOWBBINSTR;
97	/** Pointer to an instruction record. */
98	typedef DBGFFLOWBBINSTR *PDBGFFLOWBBINSTR;
99
100
101	/**
102	* A branch table identified by the graph processor.
103	*/
104	typedef struct DBGFFLOWBRANCHTBLINT
105	{
106	/** Node for the list of branch tables. */
107	RTLISTNODE NdBranchTbl;
108	/** The owning control flow graph. */
109	PDBGFFLOWINT pFlow;
110	/** Reference counter. */
111	uint32_t volatile cRefs;
112	/** The general register index holding the bracnh table base. */
113	uint8_t idxGenRegBase;
114	/** Start address of the branch table. */
115	DBGFADDRESS AddrStart;
116	/** Number of valid entries in the branch table. */
117	uint32_t cSlots;
118	/** The addresses contained in the branch table - variable in size. */
119	DBGFADDRESS aAddresses[1];
120	} DBGFFLOWBRANCHTBLINT;
121	/** Pointer to a branch table structure. */
122	typedef DBGFFLOWBRANCHTBLINT *PDBGFFLOWBRANCHTBLINT;
123
124
125	/**
126	* Internal control flow graph basic block state.
127	*/
128	typedef struct DBGFFLOWBBINT
129	{
130	/** Node for the list of all basic blocks. */
131	RTLISTNODE NdFlowBb;
132	/** The control flow graph the basic block belongs to. */
133	PDBGFFLOWINT pFlow;
134	/** Reference counter. */
135	uint32_t volatile cRefs;
136	/** Basic block end type. */
137	DBGFFLOWBBENDTYPE enmEndType;
138	/** Start address of this basic block. */
139	DBGFADDRESS AddrStart;
140	/** End address of this basic block. */
141	DBGFADDRESS AddrEnd;
142	/** Address of the block succeeding.
143	* This is valid for conditional jumps
144	* (the other target is referenced by AddrEnd+1) and
145	* unconditional jumps (not ret, iret, etc.) except
146	* if we can't infer the jump target (jmp eax for example). /
147	DBGFADDRESS AddrTarget;
148	/** The indirect branch table identified for indirect branches. */
149	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl;
150	/** Last status error code if DBGF_FLOW_BB_F_INCOMPLETE_ERR is set. */
151	int rcError;
152	/** Error message if DBGF_FLOW_BB_F_INCOMPLETE_ERR is set. */
153	char *pszErr;
154	/** Flags for this basic block. */
155	uint32_t fFlags;
156	/** Number of instructions in this basic block. */
157	uint32_t cInstr;
158	/** Maximum number of instruction records for this basic block. */
159	uint32_t cInstrMax;
160	/** Instruction records, variable in size. */
161	DBGFFLOWBBINSTR aInstr[1];
162	} DBGFFLOWBBINT;
163	/** Pointer to an internal control flow graph basic block state. */
164	typedef DBGFFLOWBBINT *PDBGFFLOWBBINT;
165
166
167	/**
168	* Control flow graph iterator state.
169	*/
170	typedef struct DBGFFLOWITINT
171	{
172	/** Pointer to the control flow graph (holding a reference). */
173	PDBGFFLOWINT pFlow;
174	/** Next basic block to return. */
175	uint32_t idxBbNext;
176	/** Array of basic blocks sorted by the specified order - variable in size. */
177	PDBGFFLOWBBINT apBb[1];
178	} DBGFFLOWITINT;
179	/** Pointer to the internal control flow graph iterator state. */
180	typedef DBGFFLOWITINT *PDBGFFLOWITINT;
181
182
183	/*********************************************************************************************************************************
184	* Internal Functions *
185	*********************************************************************************************************************************/
186
187	static uint32_t dbgfR3FlowBbReleaseInt(PDBGFFLOWBBINT pFlowBb, bool fMayDestroyFlow);
188	static void dbgfR3FlowBranchTblDestroy(PDBGFFLOWBRANCHTBLINT pFlowBranchTbl);
189
190
191	/**
192	* Checks whether both addresses are equal.
193	*
194	* @returns true if both addresses point to the same location, false otherwise.
195	* @param pAddr1 First address.
196	* @param pAddr2 Second address.
197	*/
198	static bool dbgfR3FlowAddrEqual(PDBGFADDRESS pAddr1, PDBGFADDRESS pAddr2)
199	{
200	return pAddr1->Sel == pAddr2->Sel
201	&& pAddr1->off == pAddr2->off;
202	}
203
204
205	/**
206	* Checks whether the first given address is lower than the second one.
207	*
208	* @returns true if both addresses point to the same location, false otherwise.
209	* @param pAddr1 First address.
210	* @param pAddr2 Second address.
211	*/
212	static bool dbgfR3FlowAddrLower(PDBGFADDRESS pAddr1, PDBGFADDRESS pAddr2)
213	{
214	return pAddr1->Sel == pAddr2->Sel
215	&& pAddr1->off < pAddr2->off;
216	}
217
218
219	/**
220	* Checks whether the given basic block and address intersect.
221	*
222	* @returns true if they intersect, false otherwise.
223	* @param pFlowBb The basic block to check.
224	* @param pAddr The address to check for.
225	*/
226	static bool dbgfR3FlowAddrIntersect(PDBGFFLOWBBINT pFlowBb, PDBGFADDRESS pAddr)
227	{
228	return (pFlowBb->AddrStart.Sel == pAddr->Sel)
229	&& (pFlowBb->AddrStart.off <= pAddr->off)
230	&& (pFlowBb->AddrEnd.off >= pAddr->off);
231	}
232
233
234	/**
235	* Returns the distance of the two given addresses.
236	*
237	* @returns Distance of the addresses.
238	* @param pAddr1 The first address.
239	* @param pAddr2 The second address.
240	*/
241	static RTGCUINTPTR dbgfR3FlowAddrGetDistance(PDBGFADDRESS pAddr1, PDBGFADDRESS pAddr2)
242	{
243	if (pAddr1->Sel == pAddr2->Sel)
244	{
245	if (pAddr1->off >= pAddr2->off)
246	return pAddr1->off - pAddr2->off;
247	else
248	return pAddr2->off - pAddr1->off;
249	}
250	else
251	AssertFailed();
252
253	return 0;
254	}
255
256
257	/**
258	* Creates a new basic block.
259	*
260	* @returns Pointer to the basic block on success or NULL if out of memory.
261	* @param pThis The control flow graph.
262	* @param pAddrStart The start of the basic block.
263	* @param fFlowBbFlags Additional flags for this bascic block.
264	* @param cInstrMax Maximum number of instructions this block can hold initially.
265	*/
266	static PDBGFFLOWBBINT dbgfR3FlowBbCreate(PDBGFFLOWINT pThis, PDBGFADDRESS pAddrStart, uint32_t fFlowBbFlags,
267	uint32_t cInstrMax)
268	{
269	PDBGFFLOWBBINT pFlowBb = (PDBGFFLOWBBINT)RTMemAllocZ(RT_OFFSETOF(DBGFFLOWBBINT, aInstr[cInstrMax]));
270	if (RT_LIKELY(pFlowBb))
271	{
272	RTListInit(&pFlowBb->NdFlowBb);
273	pFlowBb->cRefs = 1;
274	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_INVALID;
275	pFlowBb->pFlow = pThis;
276	pFlowBb->fFlags = DBGF_FLOW_BB_F_EMPTY \| fFlowBbFlags;
277	pFlowBb->AddrStart = *pAddrStart;
278	pFlowBb->AddrEnd = *pAddrStart;
279	pFlowBb->rcError = VINF_SUCCESS;
280	pFlowBb->pszErr = NULL;
281	pFlowBb->cInstr = 0;
282	pFlowBb->cInstrMax = cInstrMax;
283	pFlowBb->pFlowBranchTbl = NULL;
284	ASMAtomicIncU32(&pThis->cRefsBb);
285	}
286
287	return pFlowBb;
288	}
289
290
291	/**
292	* Creates an empty branch table with the given size.
293	*
294	* @returns Pointer to the empty branch table on success or NULL if out of memory.
295	* @param pThis The control flow graph.
296	* @param pAddrStart The start of the branch table.
297	* @param idxGenRegBase The general register index holding the base address.
298	* @param cSlots Number of slots the table has.
299	*/
300	static PDBGFFLOWBRANCHTBLINT dbgfR3FlowBranchTblCreate(PDBGFFLOWINT pThis, PDBGFADDRESS pAddrStart, uint8_t idxGenRegBase, uint32_t cSlots)
301	{
302	PDBGFFLOWBRANCHTBLINT pBranchTbl = (PDBGFFLOWBRANCHTBLINT)RTMemAllocZ(RT_OFFSETOF(DBGFFLOWBRANCHTBLINT, aAddresses[cSlots]));
303	if (RT_LIKELY(pBranchTbl))
304	{
305	RTListInit(&pBranchTbl->NdBranchTbl);
306	pBranchTbl->pFlow = pThis;
307	pBranchTbl->idxGenRegBase = idxGenRegBase;
308	pBranchTbl->AddrStart = *pAddrStart;
309	pBranchTbl->cSlots = cSlots;
310	pBranchTbl->cRefs = 1;
311	}
312
313	return pBranchTbl;
314	}
315
316
317	/**
318	* Destroys a control flow graph.
319	*
320	* @returns nothing.
321	* @param pThis The control flow graph to destroy.
322	*/
323	static void dbgfR3FlowDestroy(PDBGFFLOWINT pThis)
324	{
325	/* Defer destruction if there are still basic blocks referencing us. */
326	PDBGFFLOWBBINT pFlowBb = NULL;
327	PDBGFFLOWBBINT pFlowBbNext = NULL;
328	RTListForEachSafe(&pThis->LstFlowBb, pFlowBb, pFlowBbNext, DBGFFLOWBBINT, NdFlowBb)
329	{
330	dbgfR3FlowBbReleaseInt(pFlowBb, false /fMayDestroyFlow/);
331	}
332
333	Assert(!pThis->cRefs);
334	if (!pThis->cRefsBb)
335	{
336	/* Destroy the branch tables. */
337	PDBGFFLOWBRANCHTBLINT pTbl = NULL;
338	PDBGFFLOWBRANCHTBLINT pTblNext = NULL;
339	RTListForEachSafe(&pThis->LstBranchTbl, pTbl, pTblNext, DBGFFLOWBRANCHTBLINT, NdBranchTbl)
340	{
341	dbgfR3FlowBranchTblDestroy(pTbl);
342	}
343
344	RTStrCacheDestroy(pThis->hStrCacheInstr);
345	RTMemFree(pThis);
346	}
347	}
348
349
350	/**
351	* Destroys a basic block.
352	*
353	* @returns nothing.
354	* @param pFlowBb The basic block to destroy.
355	* @param fMayDestroyFlow Flag whether the control flow graph container
356	* should be destroyed when there is nothing referencing it.
357	*/
358	static void dbgfR3FlowBbDestroy(PDBGFFLOWBBINT pFlowBb, bool fMayDestroyFlow)
359	{
360	PDBGFFLOWINT pThis = pFlowBb->pFlow;
361
362	RTListNodeRemove(&pFlowBb->NdFlowBb);
363	pThis->cBbs--;
364	for (uint32_t idxInstr = 0; idxInstr < pFlowBb->cInstr; idxInstr++)
365	RTStrCacheRelease(pThis->hStrCacheInstr, pFlowBb->aInstr[idxInstr].pszInstr);
366	uint32_t cRefsBb = ASMAtomicDecU32(&pThis->cRefsBb);
367	RTMemFree(pFlowBb);
368
369	if (!cRefsBb && !pThis->cRefs && fMayDestroyFlow)
370	dbgfR3FlowDestroy(pThis);
371	}
372
373
374	/**
375	* Destroys a given branch table.
376	*
377	* @returns nothing.
378	* @param pFlowBranchTbl The flow branch table to destroy.
379	*/
380	static void dbgfR3FlowBranchTblDestroy(PDBGFFLOWBRANCHTBLINT pFlowBranchTbl)
381	{
382	RTListNodeRemove(&pFlowBranchTbl->NdBranchTbl);
383	RTMemFree(pFlowBranchTbl);
384	}
385
386
387	/**
388	* Internal basic block release worker.
389	*
390	* @returns New reference count of the released basic block, on 0
391	* it is destroyed.
392	* @param pFlowBb The basic block to release.
393	* @param fMayDestroyFlow Flag whether the control flow graph container
394	* should be destroyed when there is nothing referencing it.
395	*/
396	static uint32_t dbgfR3FlowBbReleaseInt(PDBGFFLOWBBINT pFlowBb, bool fMayDestroyFlow)
397	{
398	uint32_t cRefs = ASMAtomicDecU32(&pFlowBb->cRefs);
399	AssertMsg(cRefs < _1M, ("%#x %p %d\n", cRefs, pFlowBb, pFlowBb->enmEndType));
400	if (cRefs == 0)
401	dbgfR3FlowBbDestroy(pFlowBb, fMayDestroyFlow);
402	return cRefs;
403	}
404
405
406	/**
407	* Links the given basic block into the control flow graph.
408	*
409	* @returns nothing.
410	* @param pThis The control flow graph to link into.
411	* @param pFlowBb The basic block to link.
412	*/
413	DECLINLINE(void) dbgfR3FlowLink(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb)
414	{
415	RTListAppend(&pThis->LstFlowBb, &pFlowBb->NdFlowBb);
416	pThis->cBbs++;
417	}
418
419
420	/**
421	* Links the given branch table into the control flow graph.
422	*
423	* @returns nothing.
424	* @param pThis The control flow graph to link into.
425	* @param pBranchTbl The branch table to link.
426	*/
427	DECLINLINE(void) dbgfR3FlowBranchTblLink(PDBGFFLOWINT pThis, PDBGFFLOWBRANCHTBLINT pBranchTbl)
428	{
429	RTListAppend(&pThis->LstBranchTbl, &pBranchTbl->NdBranchTbl);
430	pThis->cBranchTbls++;
431	}
432
433
434	/**
435	* Returns the first unpopulated basic block of the given control flow graph.
436	*
437	* @returns The first unpopulated control flow graph or NULL if not found.
438	* @param pThis The control flow graph.
439	*/
440	DECLINLINE(PDBGFFLOWBBINT) dbgfR3FlowGetUnpopulatedBb(PDBGFFLOWINT pThis)
441	{
442	PDBGFFLOWBBINT pFlowBb = NULL;
443	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
444	{
445	if (pFlowBb->fFlags & DBGF_FLOW_BB_F_EMPTY)
446	return pFlowBb;
447	}
448
449	return NULL;
450	}
451
452
453	/**
454	* Returns the branch table with the given address if it exists.
455	*
456	* @returns Pointer to the branch table record or NULL if not found.
457	* @param pThis The control flow graph.
458	* @param pAddrTbl The branch table address.
459	*/
460	DECLINLINE(PDBGFFLOWBRANCHTBLINT) dbgfR3FlowBranchTblFindByAddr(PDBGFFLOWINT pThis, PDBGFADDRESS pAddrTbl)
461	{
462	PDBGFFLOWBRANCHTBLINT pTbl = NULL;
463	RTListForEach(&pThis->LstBranchTbl, pTbl, DBGFFLOWBRANCHTBLINT, NdBranchTbl)
464	{
465	if (dbgfR3FlowAddrEqual(&pTbl->AddrStart, pAddrTbl))
466	return pTbl;
467	}
468
469	return NULL;
470	}
471
472
473	/**
474	* Sets the given error status for the basic block.
475	*
476	* @returns nothing.
477	* @param pFlowBb The basic block causing the error.
478	* @param rcError The error to set.
479	* @param pszFmt Format string of the error description.
480	* @param ... Arguments for the format string.
481	*/
482	static void dbgfR3FlowBbSetError(PDBGFFLOWBBINT pFlowBb, int rcError, const char *pszFmt, ...)
483	{
484	va_list va;
485	va_start(va, pszFmt);
486
487	Assert(!(pFlowBb->fFlags & DBGF_FLOW_BB_F_INCOMPLETE_ERR));
488	pFlowBb->fFlags \|= DBGF_FLOW_BB_F_INCOMPLETE_ERR;
489	pFlowBb->fFlags &= ~DBGF_FLOW_BB_F_EMPTY;
490	pFlowBb->rcError = rcError;
491	pFlowBb->pszErr = RTStrAPrintf2V(pszFmt, va);
492	va_end(va);
493	}
494
495
496	/**
497	* Checks whether the given control flow graph contains a basic block
498	* with the given start address.
499	*
500	* @returns true if there is a basic block with the start address, false otherwise.
501	* @param pThis The control flow graph.
502	* @param pAddr The address to check for.
503	*/
504	static bool dbgfR3FlowHasBbWithStartAddr(PDBGFFLOWINT pThis, PDBGFADDRESS pAddr)
505	{
506	PDBGFFLOWBBINT pFlowBb = NULL;
507	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
508	{
509	if (dbgfR3FlowAddrEqual(&pFlowBb->AddrStart, pAddr))
510	return true;
511	}
512	return false;
513	}
514
515
516	/**
517	* Splits a given basic block into two at the given address.
518	*
519	* @returns VBox status code.
520	* @param pThis The control flow graph.
521	* @param pFlowBb The basic block to split.
522	* @param pAddr The address to split at.
523	*/
524	static int dbgfR3FlowBbSplit(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PDBGFADDRESS pAddr)
525	{
526	int rc = VINF_SUCCESS;
527	uint32_t idxInstrSplit;
528
529	/* If the block is empty it will get populated later so there is nothing to split,
530	* same if the start address equals. */
531	if ( pFlowBb->fFlags & DBGF_FLOW_BB_F_EMPTY
532	\|\| dbgfR3FlowAddrEqual(&pFlowBb->AddrStart, pAddr))
533	return VINF_SUCCESS;
534
535	/* Find the instruction to split at. */
536	for (idxInstrSplit = 1; idxInstrSplit < pFlowBb->cInstr; idxInstrSplit++)
537	if (dbgfR3FlowAddrEqual(&pFlowBb->aInstr[idxInstrSplit].AddrInstr, pAddr))
538	break;
539
540	Assert(idxInstrSplit > 0);
541
542	/*
543	* Given address might not be on instruction boundary, this is not supported
544	* so far and results in an error.
545	*/
546	if (idxInstrSplit < pFlowBb->cInstr)
547	{
548	/* Create new basic block. */
549	uint32_t cInstrNew = pFlowBb->cInstr - idxInstrSplit;
550	PDBGFFLOWBBINT pFlowBbNew = dbgfR3FlowBbCreate(pThis, &pFlowBb->aInstr[idxInstrSplit].AddrInstr,
551	0 /fFlowBbFlags/, cInstrNew);
552	if (pFlowBbNew)
553	{
554	/* Move instructions over. */
555	pFlowBbNew->cInstr = cInstrNew;
556	pFlowBbNew->AddrEnd = pFlowBb->AddrEnd;
557	pFlowBbNew->enmEndType = pFlowBb->enmEndType;
558	pFlowBbNew->AddrTarget = pFlowBb->AddrTarget;
559	pFlowBbNew->fFlags = pFlowBb->fFlags & ~DBGF_FLOW_BB_F_ENTRY;
560	pFlowBbNew->pFlowBranchTbl = pFlowBb->pFlowBranchTbl;
561	pFlowBb->pFlowBranchTbl = NULL;
562
563	/* Move any error to the new basic block and clear them in the old basic block. */
564	pFlowBbNew->rcError = pFlowBb->rcError;
565	pFlowBbNew->pszErr = pFlowBb->pszErr;
566	pFlowBb->rcError = VINF_SUCCESS;
567	pFlowBb->pszErr = NULL;
568	pFlowBb->fFlags &= ~DBGF_FLOW_BB_F_INCOMPLETE_ERR;
569
570	memcpy(&pFlowBbNew->aInstr[0], &pFlowBb->aInstr[idxInstrSplit], cInstrNew * sizeof(DBGFFLOWBBINSTR));
571	pFlowBb->cInstr = idxInstrSplit;
572	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND;
573	pFlowBb->AddrEnd = pFlowBb->aInstr[idxInstrSplit-1].AddrInstr;
574	pFlowBb->AddrTarget = pFlowBbNew->AddrStart;
575	DBGFR3AddrAdd(&pFlowBb->AddrEnd, pFlowBb->aInstr[idxInstrSplit-1].cbInstr - 1);
576	RT_BZERO(&pFlowBb->aInstr[idxInstrSplit], cInstrNew * sizeof(DBGFFLOWBBINSTR));
577
578	dbgfR3FlowLink(pThis, pFlowBbNew);
579	}
580	else
581	rc = VERR_NO_MEMORY;
582	}
583	else
584	AssertFailedStmt(rc = VERR_INVALID_STATE); /** @todo: Proper status code. */
585
586	return rc;
587	}
588
589
590	/**
591	* Makes sure there is an successor at the given address splitting already existing
592	* basic blocks if they intersect.
593	*
594	* @returns VBox status code.
595	* @param pThis The control flow graph.
596	* @param pAddrSucc The guest address the new successor should start at.
597	* @param fNewBbFlags Flags for the new basic block.
598	* @param pBranchTbl Branch table candidate for this basic block.
599	*/
600	static int dbgfR3FlowBbSuccessorAdd(PDBGFFLOWINT pThis, PDBGFADDRESS pAddrSucc,
601	uint32_t fNewBbFlags, PDBGFFLOWBRANCHTBLINT pBranchTbl)
602	{
603	PDBGFFLOWBBINT pFlowBb = NULL;
604	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
605	{
606	/*
607	* The basic block must be split if it intersects with the given address
608	* and the start address does not equal the given one.
609	*/
610	if (dbgfR3FlowAddrIntersect(pFlowBb, pAddrSucc))
611	return dbgfR3FlowBbSplit(pThis, pFlowBb, pAddrSucc);
612	}
613
614	int rc = VINF_SUCCESS;
615	pFlowBb = dbgfR3FlowBbCreate(pThis, pAddrSucc, fNewBbFlags, 10);
616	if (pFlowBb)
617	{
618	pFlowBb->pFlowBranchTbl = pBranchTbl;
619	dbgfR3FlowLink(pThis, pFlowBb);
620	}
621	else
622	rc = VERR_NO_MEMORY;
623
624	return rc;
625	}
626
627
628	/**
629	* Returns whether the parameter indicates an indirect branch.
630	*
631	* @returns Flag whether this is an indirect branch.
632	* @param pDisParam The parameter from the disassembler.
633	*/
634	DECLINLINE(bool) dbgfR3FlowBranchTargetIsIndirect(PDISOPPARAM pDisParam)
635	{
636	bool fIndirect = true;
637
638	if ( pDisParam->fUse & (DISUSE_IMMEDIATE8 \| DISUSE_IMMEDIATE16 \| DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64)
639	\|\| pDisParam->fUse & (DISUSE_IMMEDIATE8_REL \| DISUSE_IMMEDIATE16_REL \| DISUSE_IMMEDIATE32_REL \| DISUSE_IMMEDIATE64_REL))
640	fIndirect = false;
641
642	return fIndirect;
643	}
644
645
646	/**
647	* Resolves the direct branch target address if possible from the given instruction address
648	* and instruction parameter.
649	*
650	* @returns VBox status code.
651	* @param pUVM The usermode VM handle.
652	* @param idCpu CPU id for resolving the address.
653	* @param pDisParam The parameter from the disassembler.
654	* @param pAddrInstr The instruction address.
655	* @param cbInstr Size of instruction in bytes.
656	* @param fRelJmp Flag whether this is a reltive jump.
657	* @param pAddrJmpTarget Where to store the address to the jump target on success.
658	*/
659	static int dbgfR3FlowQueryDirectBranchTarget(PUVM pUVM, VMCPUID idCpu, PDISOPPARAM pDisParam, PDBGFADDRESS pAddrInstr,
660	uint32_t cbInstr, bool fRelJmp, PDBGFADDRESS pAddrJmpTarget)
661	{
662	int rc = VINF_SUCCESS;
663
664	Assert(!dbgfR3FlowBranchTargetIsIndirect(pDisParam));
665
666	/* Relative jumps are always from the beginning of the next instruction. */
667	pAddrJmpTarget = pAddrInstr;
668	DBGFR3AddrAdd(pAddrJmpTarget, cbInstr);
669
670	if (fRelJmp)
671	{
672	RTGCINTPTR iRel = 0;
673	if (pDisParam->fUse & DISUSE_IMMEDIATE8_REL)
674	iRel = (int8_t)pDisParam->uValue;
675	else if (pDisParam->fUse & DISUSE_IMMEDIATE16_REL)
676	iRel = (int16_t)pDisParam->uValue;
677	else if (pDisParam->fUse & DISUSE_IMMEDIATE32_REL)
678	iRel = (int32_t)pDisParam->uValue;
679	else if (pDisParam->fUse & DISUSE_IMMEDIATE64_REL)
680	iRel = (int64_t)pDisParam->uValue;
681	else
682	AssertFailedStmt(rc = VERR_NOT_SUPPORTED);
683
684	if (iRel < 0)
685	DBGFR3AddrSub(pAddrJmpTarget, -iRel);
686	else
687	DBGFR3AddrAdd(pAddrJmpTarget, iRel);
688	}
689	else
690	{
691	if (pDisParam->fUse & (DISUSE_IMMEDIATE8 \| DISUSE_IMMEDIATE16 \| DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64))
692	{
693	if (DBGFADDRESS_IS_FLAT(pAddrInstr))
694	DBGFR3AddrFromFlat(pUVM, pAddrJmpTarget, pDisParam->uValue);
695	else
696	DBGFR3AddrFromSelOff(pUVM, idCpu, pAddrJmpTarget, pAddrInstr->Sel, pDisParam->uValue);
697	}
698	else
699	AssertFailedStmt(rc = VERR_INVALID_STATE);
700	}
701
702	return rc;
703	}
704
705
706	/**
707	* Returns the CPU mode based on the given assembler flags.
708	*
709	* @returns CPU mode.
710	* @param pUVM The user mode VM handle.
711	* @param idCpu CPU id for disassembling.
712	* @param fFlagsDisasm The flags used for disassembling.
713	*/
714	static CPUMMODE dbgfR3FlowGetDisasCpuMode(PUVM pUVM, VMCPUID idCpu, uint32_t fFlagsDisasm)
715	{
716	CPUMMODE enmMode = CPUMMODE_INVALID;
717	uint32_t fDisasMode = fFlagsDisasm & DBGF_DISAS_FLAGS_MODE_MASK;
718	if (fDisasMode == DBGF_DISAS_FLAGS_DEFAULT_MODE)
719	enmMode = DBGFR3CpuGetMode(pUVM, idCpu);
720	else if ( fDisasMode == DBGF_DISAS_FLAGS_16BIT_MODE
721	\|\| fDisasMode == DBGF_DISAS_FLAGS_16BIT_REAL_MODE)
722	enmMode = CPUMMODE_REAL;
723	else if (fDisasMode == DBGF_DISAS_FLAGS_32BIT_MODE)
724	enmMode = CPUMMODE_PROTECTED;
725	else if (fDisasMode == DBGF_DISAS_FLAGS_32BIT_MODE)
726	enmMode = CPUMMODE_LONG;
727	else
728	AssertFailed();
729
730	return enmMode;
731	}
732
733
734	/**
735	* Searches backwards in the given basic block starting the given instruction index for
736	* a mov instruction with the given register as the target where the constant looks like
737	* a pointer.
738	*
739	* @returns Flag whether a candidate was found.
740	* @param idxRegTgt The general register the mov targets.
741	* @param cbPtr The pointer size to look for.
742	* @param pUVM The user mode VM handle.
743	* @param idCpu CPU id for disassembling.
744	* @param fFlagsDisasm The flags to use for disassembling.
745	* @param pidxInstrStart The instruction index to start searching for on input,
746	* The last instruction evaluated on output.
747	* @param pAddrDest Where to store the candidate address on success.
748	*/
749	static bool dbgfR3FlowSearchMovWithConstantPtrSizeBackwards(PDBGFFLOWBBINT pFlowBb, uint8_t idxRegTgt, uint32_t cbPtr,
750	PUVM pUVM, VMCPUID idCpu, uint32_t fFlagsDisasm,
751	uint32_t *pidxInstrStart, PDBGFADDRESS pAddrDest)
752	{
753	bool fFound = false;
754	uint32_t idxInstrCur = *pidxInstrStart;
755	uint32_t cInstrCheck = idxInstrCur + 1;
756
757	for (;;)
758	{
759	/** @todo: Avoid to disassemble again. */
760	PDBGFFLOWBBINSTR pInstr = &pFlowBb->aInstr[idxInstrCur];
761	DBGFDISSTATE DisState;
762	char szOutput[_4K];
763
764	int rc = dbgfR3DisasInstrStateEx(pUVM, idCpu, &pInstr->AddrInstr, fFlagsDisasm,
765	&szOutput[0], sizeof(szOutput), &DisState);
766	if (RT_SUCCESS(rc))
767	{
768	if ( DisState.pCurInstr->uOpcode == OP_MOV
769	&& (DisState.Param1.fUse & (DISUSE_REG_GEN16 \| DISUSE_REG_GEN32 \| DISUSE_REG_GEN64))
770	&& DisState.Param1.Base.idxGenReg == idxRegTgt
771	/&& DisState.Param1.cb == cbPtr/
772	&& DisState.Param2.cb == cbPtr
773	&& (DisState.Param2.fUse & (DISUSE_IMMEDIATE16 \| DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64)))
774	{
775	/* Found possible candidate. */
776	fFound = true;
777	if (DBGFADDRESS_IS_FLAT(&pInstr->AddrInstr))
778	DBGFR3AddrFromFlat(pUVM, pAddrDest, DisState.Param2.uValue);
779	else
780	DBGFR3AddrFromSelOff(pUVM, idCpu, pAddrDest, pInstr->AddrInstr.Sel, DisState.Param2.uValue);
781	break;
782	}
783	}
784	else
785	break;
786
787	cInstrCheck--;
788	if (!cInstrCheck)
789	break;
790
791	idxInstrCur--;
792	}
793
794	*pidxInstrStart = idxInstrCur;
795	return fFound;
796	}
797
798
799	/**
800	* Verifies the given branch table candidate and adds it to the control flow graph on success.
801	*
802	* @returns VBox status code.
803	* @param pThis The flow control graph.
804	* @param pFlowBb The basic block causing the indirect branch.
805	* @param pAddrBranchTbl Address of the branch table location.
806	* @param idxGenRegBase The general register holding the base address.
807	* @param cbPtr Guest pointer size.
808	* @param pUVM The user mode VM handle.
809	* @param idCpu CPU id for disassembling.
810	*
811	* @todo Handle branch tables greater than 4KB (lazy coder).
812	*/
813	static int dbgfR3FlowBranchTblVerifyAdd(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PDBGFADDRESS pAddrBranchTbl,
814	uint8_t idxGenRegBase, uint32_t cbPtr, PUVM pUVM, VMCPUID idCpu)
815	{
816	int rc = VINF_SUCCESS;
817	PDBGFFLOWBRANCHTBLINT pBranchTbl = dbgfR3FlowBranchTblFindByAddr(pThis, pAddrBranchTbl);
818
819	if (!pBranchTbl)
820	{
821	uint32_t cSlots = 0;
822	uint8_t abBuf[_4K];
823
824	rc = DBGFR3MemRead(pUVM, idCpu, pAddrBranchTbl, &abBuf[0], sizeof(abBuf));
825	if (RT_SUCCESS(rc))
826	{
827	uint8_t *pbBuf = &abBuf[0];
828	while (pbBuf < &abBuf[0] + sizeof(abBuf))
829	{
830	DBGFADDRESS AddrDest;
831	RTGCUINTPTR GCPtr = cbPtr == sizeof(uint64_t)
832	? (uint64_t )pbBuf
833	: cbPtr == sizeof(uint32_t)
834	? (uint32_t )pbBuf
835	: (uint16_t )pbBuf;
836	pbBuf += cbPtr;
837
838	if (DBGFADDRESS_IS_FLAT(pAddrBranchTbl))
839	DBGFR3AddrFromFlat(pUVM, &AddrDest, GCPtr);
840	else
841	DBGFR3AddrFromSelOff(pUVM, idCpu, &AddrDest, pAddrBranchTbl->Sel, GCPtr);
842
843	if (dbgfR3FlowAddrGetDistance(&AddrDest, &pFlowBb->AddrEnd) > _512K)
844	break;
845
846	cSlots++;
847	}
848
849	/* If there are any slots use it. */
850	if (cSlots)
851	{
852	pBranchTbl = dbgfR3FlowBranchTblCreate(pThis, pAddrBranchTbl, idxGenRegBase, cSlots);
853	if (pBranchTbl)
854	{
855	/* Get the addresses. */
856	for (unsigned i = 0; i < cSlots && RT_SUCCESS(rc); i++)
857	{
858	RTGCUINTPTR GCPtr = cbPtr == sizeof(uint64_t)
859	? (uint64_t )&abBuf[i * cbPtr]
860	: cbPtr == sizeof(uint32_t)
861	? (uint32_t )&abBuf[i * cbPtr]
862	: (uint16_t )&abBuf[i * cbPtr];
863
864	if (DBGFADDRESS_IS_FLAT(pAddrBranchTbl))
865	DBGFR3AddrFromFlat(pUVM, &pBranchTbl->aAddresses[i], GCPtr);
866	else
867	DBGFR3AddrFromSelOff(pUVM, idCpu, &pBranchTbl->aAddresses[i],
868	pAddrBranchTbl->Sel, GCPtr);
869	rc = dbgfR3FlowBbSuccessorAdd(pThis, &pBranchTbl->aAddresses[i], DBGF_FLOW_BB_F_BRANCH_TABLE,
870	pBranchTbl);
871	}
872	dbgfR3FlowBranchTblLink(pThis, pBranchTbl);
873	}
874	else
875	rc = VERR_NO_MEMORY;
876	}
877	}
878	}
879
880	if (pBranchTbl)
881	pFlowBb->pFlowBranchTbl = pBranchTbl;
882
883	return rc;
884	}
885
886
887	/**
888	* Checks whether the location for the branch target candidate contains a valid code address.
889	*
890	* @returns VBox status code.
891	* @param pThis The flow control graph.
892	* @param pFlowBb The basic block causing the indirect branch.
893	* @param pAddrBranchTgt Address of the branch target location.
894	* @param idxGenRegBase The general register holding the address of the location.
895	* @param cbPtr Guest pointer size.
896	* @param pUVM The user mode VM handle.
897	* @param idCpu CPU id for disassembling.
898	* @param fBranchTbl Flag whether this is a possible branch table containing multiple
899	* targets.
900	*/
901	static int dbgfR3FlowCheckBranchTargetLocation(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PDBGFADDRESS pAddrBranchTgt,
902	uint8_t idxGenRegBase, uint32_t cbPtr, PUVM pUVM, VMCPUID idCpu, bool fBranchTbl)
903	{
904	int rc = VINF_SUCCESS;
905
906	if (!fBranchTbl)
907	{
908	union { uint16_t u16Val; uint32_t u32Val; uint64_t u64Val; } uVal;
909	rc = DBGFR3MemRead(pUVM, idCpu, pAddrBranchTgt, &uVal, cbPtr);
910	if (RT_SUCCESS(rc))
911	{
912	DBGFADDRESS AddrTgt;
913	RTGCUINTPTR GCPtr = cbPtr == sizeof(uint64_t)
914	? uVal.u64Val
915	: cbPtr == sizeof(uint32_t)
916	? uVal.u32Val
917	: uVal.u16Val;
918	if (DBGFADDRESS_IS_FLAT(pAddrBranchTgt))
919	DBGFR3AddrFromFlat(pUVM, &AddrTgt, GCPtr);
920	else
921	DBGFR3AddrFromSelOff(pUVM, idCpu, &AddrTgt, pAddrBranchTgt->Sel, GCPtr);
922
923	if (dbgfR3FlowAddrGetDistance(&AddrTgt, &pFlowBb->AddrEnd) <= _128K)
924	{
925	/* Finish the basic block. */
926	pFlowBb->AddrTarget = AddrTgt;
927	rc = dbgfR3FlowBbSuccessorAdd(pThis, &AddrTgt,
928	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
929	pFlowBb->pFlowBranchTbl);
930	}
931	else
932	rc = VERR_NOT_FOUND;
933	}
934	}
935	else
936	rc = dbgfR3FlowBranchTblVerifyAdd(pThis, pFlowBb, pAddrBranchTgt,
937	idxGenRegBase, cbPtr, pUVM, idCpu);
938
939	return rc;
940	}
941
942
943	/**
944	* Tries to resolve the indirect branch.
945	*
946	* @returns VBox status code.
947	* @param pThis The flow control graph.
948	* @param pFlowBb The basic block causing the indirect branch.
949	* @param pUVM The user mode VM handle.
950	* @param idCpu CPU id for disassembling.
951	* @param pDisParam The parameter from the disassembler.
952	* @param fFlagsDisasm Flags for the disassembler.
953	*/
954	static int dbgfR3FlowTryResolveIndirectBranch(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PUVM pUVM,
955	VMCPUID idCpu, PDISOPPARAM pDisParam, uint32_t fFlagsDisasm)
956	{
957	Assert(dbgfR3FlowBranchTargetIsIndirect(pDisParam));
958
959	uint32_t cbPtr = 0;
960	CPUMMODE enmMode = dbgfR3FlowGetDisasCpuMode(pUVM, idCpu, fFlagsDisasm);
961
962	switch (enmMode)
963	{
964	case CPUMMODE_REAL:
965	cbPtr = sizeof(uint16_t);
966	break;
967	case CPUMMODE_PROTECTED:
968	cbPtr = sizeof(uint32_t);
969	break;
970	case CPUMMODE_LONG:
971	cbPtr = sizeof(uint64_t);
972	break;
973	default:
974	AssertMsgFailed(("Invalid CPU mode %u\n", enmMode));
975	}
976
977	if (pDisParam->fUse & DISUSE_BASE)
978	{
979	uint8_t idxRegBase = pDisParam->Base.idxGenReg;
980
981	/* Check that the used register size and the pointer size match. */
982	if ( ((pDisParam->fUse & DISUSE_REG_GEN16) && cbPtr == sizeof(uint16_t))
983	\|\| ((pDisParam->fUse & DISUSE_REG_GEN32) && cbPtr == sizeof(uint32_t))
984	\|\| ((pDisParam->fUse & DISUSE_REG_GEN64) && cbPtr == sizeof(uint64_t)))
985	{
986	/*
987	* Search all instructions backwards until a move to the used general register
988	* is detected with a constant using the pointer size.
989	*/
990	uint32_t idxInstrStart = pFlowBb->cInstr - 1 - 1; /* Don't look at the branch. */
991	bool fCandidateFound = false;
992	bool fBranchTbl = RT_BOOL(pDisParam->fUse & DISUSE_INDEX);
993	DBGFADDRESS AddrBranchTgt;
994	do
995	{
996	fCandidateFound = dbgfR3FlowSearchMovWithConstantPtrSizeBackwards(pFlowBb, idxRegBase, cbPtr,
997	pUVM, idCpu, fFlagsDisasm,
998	&idxInstrStart, &AddrBranchTgt);
999	if (fCandidateFound)
1000	{
1001	/* Check that the address is not too far away from the instruction address. */
1002	RTGCUINTPTR offPtr = dbgfR3FlowAddrGetDistance(&AddrBranchTgt, &pFlowBb->AddrEnd);
1003	if (offPtr <= 20 * _1M)
1004	{
1005	/* Read the content at the address and check that it is near this basic block too. */
1006	int rc = dbgfR3FlowCheckBranchTargetLocation(pThis, pFlowBb, &AddrBranchTgt, idxRegBase,
1007	cbPtr, pUVM, idCpu, fBranchTbl);
1008	if (RT_SUCCESS(rc))
1009	break;
1010	fCandidateFound = false;
1011	}
1012
1013	if (idxInstrStart > 0)
1014	idxInstrStart--;
1015	}
1016	} while (idxInstrStart > 0 && !fCandidateFound);
1017	}
1018	else
1019	dbgfR3FlowBbSetError(pFlowBb, VERR_INVALID_STATE,
1020	"The base register size and selected pointer size do not match (fUse=%#x cbPtr=%u)",
1021	pDisParam->fUse, cbPtr);
1022	}
1023
1024	return VINF_SUCCESS;
1025	}
1026
1027
1028	/**
1029	* Tries to resolve the indirect branch.
1030	*
1031	* @returns VBox status code.
1032	* @param pThis The flow control graph.
1033	* @param pFlowBb The basic block causing the indirect branch.
1034	* @param pUVM The user mode VM handle.
1035	* @param idCpu CPU id for disassembling.
1036	* @param pDisParam The parameter from the disassembler.
1037	* @param fFlagsDisasm Flags for the disassembler.
1038	*/
1039	static int dbgfR3FlowBbCheckBranchTblCandidate(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PUVM pUVM,
1040	VMCPUID idCpu, PDISOPPARAM pDisParam, uint32_t fFlagsDisasm)
1041	{
1042	int rc = VINF_SUCCESS;
1043
1044	Assert(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE && pFlowBb->pFlowBranchTbl);
1045
1046	uint32_t cbPtr = 0;
1047	CPUMMODE enmMode = dbgfR3FlowGetDisasCpuMode(pUVM, idCpu, fFlagsDisasm);
1048
1049	switch (enmMode)
1050	{
1051	case CPUMMODE_REAL:
1052	cbPtr = sizeof(uint16_t);
1053	break;
1054	case CPUMMODE_PROTECTED:
1055	cbPtr = sizeof(uint32_t);
1056	break;
1057	case CPUMMODE_LONG:
1058	cbPtr = sizeof(uint64_t);
1059	break;
1060	default:
1061	AssertMsgFailed(("Invalid CPU mode %u\n", enmMode));
1062	}
1063
1064	if (pDisParam->fUse & DISUSE_BASE)
1065	{
1066	uint8_t idxRegBase = pDisParam->Base.idxGenReg;
1067
1068	/* Check that the used register size and the pointer size match. */
1069	if ( ((pDisParam->fUse & DISUSE_REG_GEN16) && cbPtr == sizeof(uint16_t))
1070	\|\| ((pDisParam->fUse & DISUSE_REG_GEN32) && cbPtr == sizeof(uint32_t))
1071	\|\| ((pDisParam->fUse & DISUSE_REG_GEN64) && cbPtr == sizeof(uint64_t)))
1072	{
1073	if (idxRegBase != pFlowBb->pFlowBranchTbl->idxGenRegBase)
1074	{
1075	/* Try to find the new branch table. */
1076	pFlowBb->pFlowBranchTbl = NULL;
1077	rc = dbgfR3FlowTryResolveIndirectBranch(pThis, pFlowBb, pUVM, idCpu, pDisParam, fFlagsDisasm);
1078	}
1079	/** @todo: else check that the base register is not modified in this basic block. */
1080	}
1081	else
1082	dbgfR3FlowBbSetError(pFlowBb, VERR_INVALID_STATE,
1083	"The base register size and selected pointer size do not match (fUse=%#x cbPtr=%u)",
1084	pDisParam->fUse, cbPtr);
1085	}
1086	else
1087	dbgfR3FlowBbSetError(pFlowBb, VERR_INVALID_STATE,
1088	"The instruction does not use a register");
1089
1090	return rc;
1091	}
1092
1093
1094	/**
1095	* Processes and fills one basic block.
1096	*
1097	* @returns VBox status code.
1098	* @param pUVM The user mode VM handle.
1099	* @param idCpu CPU id for disassembling.
1100	* @param pThis The control flow graph to populate.
1101	* @param pFlowBb The basic block to fill.
1102	* @param cbDisasmMax The maximum amount to disassemble.
1103	* @param fFlags Combination of DBGF_DISAS_FLAGS_*.
1104	*/
1105	static int dbgfR3FlowBbProcess(PUVM pUVM, VMCPUID idCpu, PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb,
1106	uint32_t cbDisasmMax, uint32_t fFlags)
1107	{
1108	int rc = VINF_SUCCESS;
1109	uint32_t cbDisasmLeft = cbDisasmMax ? cbDisasmMax : UINT32_MAX;
1110	DBGFADDRESS AddrDisasm = pFlowBb->AddrEnd;
1111
1112	Assert(pFlowBb->fFlags & DBGF_FLOW_BB_F_EMPTY);
1113
1114	/*
1115	* Disassemble instruction by instruction until we get a conditional or
1116	* unconditional jump or some sort of return.
1117	*/
1118	while ( cbDisasmLeft
1119	&& RT_SUCCESS(rc))
1120	{
1121	DBGFDISSTATE DisState;
1122	char szOutput[_4K];
1123
1124	/*
1125	* Before disassembling we have to check whether the address belongs
1126	* to another basic block and stop here.
1127	*/
1128	if ( !(pFlowBb->fFlags & DBGF_FLOW_BB_F_EMPTY)
1129	&& dbgfR3FlowHasBbWithStartAddr(pThis, &AddrDisasm))
1130	{
1131	pFlowBb->AddrTarget = AddrDisasm;
1132	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND;
1133	break;
1134	}
1135
1136	pFlowBb->fFlags &= ~DBGF_FLOW_BB_F_EMPTY;
1137
1138	rc = dbgfR3DisasInstrStateEx(pUVM, idCpu, &AddrDisasm, fFlags,
1139	&szOutput[0], sizeof(szOutput), &DisState);
1140	if (RT_SUCCESS(rc))
1141	{
1142	cbDisasmLeft -= DisState.cbInstr;
1143
1144	if (pFlowBb->cInstr == pFlowBb->cInstrMax)
1145	{
1146	/* Reallocate. */
1147	RTListNodeRemove(&pFlowBb->NdFlowBb);
1148	PDBGFFLOWBBINT pFlowBbNew = (PDBGFFLOWBBINT)RTMemRealloc(pFlowBb, RT_OFFSETOF(DBGFFLOWBBINT, aInstr[pFlowBb->cInstrMax + 10]));
1149	if (pFlowBbNew)
1150	{
1151	pFlowBbNew->cInstrMax += 10;
1152	pFlowBb = pFlowBbNew;
1153	}
1154	else
1155	rc = VERR_NO_MEMORY;
1156	RTListAppend(&pThis->LstFlowBb, &pFlowBb->NdFlowBb);
1157	}
1158
1159	if (RT_SUCCESS(rc))
1160	{
1161	PDBGFFLOWBBINSTR pInstr = &pFlowBb->aInstr[pFlowBb->cInstr];
1162
1163	pInstr->AddrInstr = AddrDisasm;
1164	pInstr->cbInstr = DisState.cbInstr;
1165	pInstr->pszInstr = RTStrCacheEnter(pThis->hStrCacheInstr, &szOutput[0]);
1166	pFlowBb->cInstr++;
1167
1168	pFlowBb->AddrEnd = AddrDisasm;
1169	DBGFR3AddrAdd(&pFlowBb->AddrEnd, pInstr->cbInstr - 1);
1170	DBGFR3AddrAdd(&AddrDisasm, pInstr->cbInstr);
1171
1172	/*
1173	* Check control flow instructions and create new basic blocks
1174	* marking the current one as complete.
1175	*/
1176	if (DisState.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
1177	{
1178	uint16_t uOpc = DisState.pCurInstr->uOpcode;
1179
1180	if ( uOpc == OP_RETN \|\| uOpc == OP_RETF \|\| uOpc == OP_IRET
1181	\|\| uOpc == OP_SYSEXIT \|\| uOpc == OP_SYSRET)
1182	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_EXIT;
1183	else if (uOpc == OP_JMP)
1184	{
1185	Assert(DisState.pCurInstr->fOpType & DISOPTYPE_UNCOND_CONTROLFLOW);
1186
1187	if (dbgfR3FlowBranchTargetIsIndirect(&DisState.Param1))
1188	{
1189	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND_INDIRECT_JMP;
1190
1191	if (pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE)
1192	{
1193	Assert(pThis->fFlags & DBGF_FLOW_CREATE_F_TRY_RESOLVE_INDIRECT_BRANCHES);
1194
1195	/*
1196	* This basic block was already discovered by parsing a jump table and
1197	* there should be a candidate for the branch table. Check whether it uses the
1198	* same branch table.
1199	*/
1200	rc = dbgfR3FlowBbCheckBranchTblCandidate(pThis, pFlowBb, pUVM, idCpu,
1201	&DisState.Param1, fFlags);
1202	}
1203	else
1204	{
1205	if (pThis->fFlags & DBGF_FLOW_CREATE_F_TRY_RESOLVE_INDIRECT_BRANCHES)
1206	rc = dbgfR3FlowTryResolveIndirectBranch(pThis, pFlowBb, pUVM, idCpu,
1207	&DisState.Param1, fFlags);
1208	else
1209	dbgfR3FlowBbSetError(pFlowBb, VERR_NOT_SUPPORTED,
1210	"Detected indirect branch and resolving it not being enabled");
1211	}
1212	}
1213	else
1214	{
1215	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND_JMP;
1216
1217	/* Create one new basic block with the jump target address. */
1218	rc = dbgfR3FlowQueryDirectBranchTarget(pUVM, idCpu, &DisState.Param1, &pInstr->AddrInstr, pInstr->cbInstr,
1219	RT_BOOL(DisState.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW),
1220	&pFlowBb->AddrTarget);
1221	if (RT_SUCCESS(rc))
1222	rc = dbgfR3FlowBbSuccessorAdd(pThis, &pFlowBb->AddrTarget,
1223	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
1224	pFlowBb->pFlowBranchTbl);
1225	}
1226	}
1227	else if (uOpc != OP_CALL)
1228	{
1229	Assert(DisState.pCurInstr->fOpType & DISOPTYPE_COND_CONTROLFLOW);
1230	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_COND;
1231
1232	/*
1233	* Create two new basic blocks, one with the jump target address
1234	* and one starting after the current instruction.
1235	*/
1236	rc = dbgfR3FlowBbSuccessorAdd(pThis, &AddrDisasm,
1237	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
1238	pFlowBb->pFlowBranchTbl);
1239	if (RT_SUCCESS(rc))
1240	{
1241	rc = dbgfR3FlowQueryDirectBranchTarget(pUVM, idCpu, &DisState.Param1, &pInstr->AddrInstr, pInstr->cbInstr,
1242	RT_BOOL(DisState.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW),
1243	&pFlowBb->AddrTarget);
1244	if (RT_SUCCESS(rc))
1245	rc = dbgfR3FlowBbSuccessorAdd(pThis, &pFlowBb->AddrTarget,
1246	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
1247	pFlowBb->pFlowBranchTbl);
1248	}
1249	}
1250
1251	if (RT_FAILURE(rc))
1252	dbgfR3FlowBbSetError(pFlowBb, rc, "Adding successor blocks failed with %Rrc", rc);
1253
1254	/* Quit disassembling. */
1255	if ( uOpc != OP_CALL
1256	\|\| RT_FAILURE(rc))
1257	break;
1258	}
1259	}
1260	else
1261	dbgfR3FlowBbSetError(pFlowBb, rc, "Increasing basic block failed with %Rrc", rc);
1262	}
1263	else
1264	dbgfR3FlowBbSetError(pFlowBb, rc, "Disassembling the instruction failed with %Rrc", rc);
1265	}
1266
1267	return VINF_SUCCESS;
1268	}
1269
1270	/**
1271	* Populate all empty basic blocks.
1272	*
1273	* @returns VBox status code.
1274	* @param pUVM The user mode VM handle.
1275	* @param idCpu CPU id for disassembling.
1276	* @param pThis The control flow graph to populate.
1277	* @param pAddrStart The start address to disassemble at.
1278	* @param cbDisasmMax The maximum amount to disassemble.
1279	* @param fFlags Combination of DBGF_DISAS_FLAGS_*.
1280	*/
1281	static int dbgfR3FlowPopulate(PUVM pUVM, VMCPUID idCpu, PDBGFFLOWINT pThis, PDBGFADDRESS pAddrStart,
1282	uint32_t cbDisasmMax, uint32_t fFlags)
1283	{
1284	int rc = VINF_SUCCESS;
1285	PDBGFFLOWBBINT pFlowBb = dbgfR3FlowGetUnpopulatedBb(pThis);
1286	DBGFADDRESS AddrEnd = *pAddrStart;
1287	DBGFR3AddrAdd(&AddrEnd, cbDisasmMax);
1288
1289	while (VALID_PTR(pFlowBb))
1290	{
1291	rc = dbgfR3FlowBbProcess(pUVM, idCpu, pThis, pFlowBb, cbDisasmMax, fFlags);
1292	if (RT_FAILURE(rc))
1293	break;
1294
1295	pFlowBb = dbgfR3FlowGetUnpopulatedBb(pThis);
1296	}
1297
1298	return rc;
1299	}
1300
1301	/**
1302	* Creates a new control flow graph from the given start address.
1303	*
1304	* @returns VBox status code.
1305	* @param pUVM The user mode VM handle.
1306	* @param idCpu CPU id for disassembling.
1307	* @param pAddressStart Where to start creating the control flow graph.
1308	* @param cbDisasmMax Limit the amount of bytes to disassemble, 0 for no limit.
1309	* @param fFlagsFlow Combination of DBGF_FLOW_CREATE_F_* to control the creation of the flow graph.
1310	* @param fFlagsDisasm Combination of DBGF_DISAS_FLAGS_* controlling the style of the disassembled
1311	* instructions.
1312	* @param phFlow Where to store the handle to the control flow graph on success.
1313	*/
1314	VMMR3DECL(int) DBGFR3FlowCreate(PUVM pUVM, VMCPUID idCpu, PDBGFADDRESS pAddressStart, uint32_t cbDisasmMax,
1315	uint32_t fFlagsFlow, uint32_t fFlagsDisasm, PDBGFFLOW phFlow)
1316	{
1317	UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
1318	PVM pVM = pUVM->pVM;
1319	VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
1320	AssertReturn(idCpu < pUVM->cCpus, VERR_INVALID_CPU_ID);
1321	AssertPtrReturn(pAddressStart, VERR_INVALID_POINTER);
1322	AssertReturn(!(fFlagsDisasm & ~DBGF_DISAS_FLAGS_VALID_MASK), VERR_INVALID_PARAMETER);
1323	AssertReturn((fFlagsDisasm & DBGF_DISAS_FLAGS_MODE_MASK) <= DBGF_DISAS_FLAGS_64BIT_MODE, VERR_INVALID_PARAMETER);
1324
1325	/* Create the control flow graph container. */
1326	int rc = VINF_SUCCESS;
1327	PDBGFFLOWINT pThis = (PDBGFFLOWINT)RTMemAllocZ(sizeof(DBGFFLOWINT));
1328	if (RT_LIKELY(pThis))
1329	{
1330	rc = RTStrCacheCreate(&pThis->hStrCacheInstr, "DBGFFLOW");
1331	if (RT_SUCCESS(rc))
1332	{
1333	pThis->cRefs = 1;
1334	pThis->cRefsBb = 0;
1335	pThis->cBbs = 0;
1336	pThis->cBranchTbls = 0;
1337	pThis->fFlags = fFlagsFlow;
1338	RTListInit(&pThis->LstFlowBb);
1339	RTListInit(&pThis->LstBranchTbl);
1340	/* Create the entry basic block and start the work. */
1341
1342	PDBGFFLOWBBINT pFlowBb = dbgfR3FlowBbCreate(pThis, pAddressStart, DBGF_FLOW_BB_F_ENTRY, 10);
1343	if (RT_LIKELY(pFlowBb))
1344	{
1345	dbgfR3FlowLink(pThis, pFlowBb);
1346	rc = dbgfR3FlowPopulate(pUVM, idCpu, pThis, pAddressStart, cbDisasmMax, fFlagsDisasm);
1347	if (RT_SUCCESS(rc))
1348	{
1349	*phFlow = pThis;
1350	return VINF_SUCCESS;
1351	}
1352	}
1353	else
1354	rc = VERR_NO_MEMORY;
1355	}
1356
1357	ASMAtomicDecU32(&pThis->cRefs);
1358	dbgfR3FlowDestroy(pThis);
1359	}
1360	else
1361	rc = VERR_NO_MEMORY;
1362
1363	return rc;
1364	}
1365
1366
1367	/**
1368	* Retains the control flow graph handle.
1369	*
1370	* @returns Current reference count.
1371	* @param hFlow The control flow graph handle to retain.
1372	*/
1373	VMMR3DECL(uint32_t) DBGFR3FlowRetain(DBGFFLOW hFlow)
1374	{
1375	PDBGFFLOWINT pThis = hFlow;
1376	AssertPtrReturn(pThis, UINT32_MAX);
1377
1378	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
1379	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
1380	return cRefs;
1381	}
1382
1383
1384	/**
1385	* Releases the control flow graph handle.
1386	*
1387	* @returns Current reference count, on 0 the control flow graph will be destroyed.
1388	* @param hFlow The control flow graph handle to release.
1389	*/
1390	VMMR3DECL(uint32_t) DBGFR3FlowRelease(DBGFFLOW hFlow)
1391	{
1392	PDBGFFLOWINT pThis = hFlow;
1393	if (!pThis)
1394	return 0;
1395	AssertPtrReturn(pThis, UINT32_MAX);
1396
1397	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
1398	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
1399	if (cRefs == 0)
1400	dbgfR3FlowDestroy(pThis);
1401	return cRefs;
1402	}
1403
1404
1405	/**
1406	* Queries the basic block denoting the entry point into the control flow graph.
1407	*
1408	* @returns VBox status code.
1409	* @param hFlow The control flow graph handle.
1410	* @param phFlowBb Where to store the basic block handle on success.
1411	*/
1412	VMMR3DECL(int) DBGFR3FlowQueryStartBb(DBGFFLOW hFlow, PDBGFFLOWBB phFlowBb)
1413	{
1414	PDBGFFLOWINT pThis = hFlow;
1415	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
1416
1417	PDBGFFLOWBBINT pFlowBb = NULL;
1418	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
1419	{
1420	if (pFlowBb->fFlags & DBGF_FLOW_BB_F_ENTRY)
1421	{
1422	*phFlowBb = pFlowBb;
1423	return VINF_SUCCESS;
1424	}
1425	}
1426
1427	AssertFailed(); /* Should never get here. */
1428	return VERR_INTERNAL_ERROR;
1429	}
1430
1431
1432	/**
1433	* Queries a basic block in the given control flow graph which covers the given
1434	* address.
1435	*
1436	* @returns VBox status code.
1437	* @retval VERR_NOT_FOUND if there is no basic block intersecting with the address.
1438	* @param hFlow The control flow graph handle.
1439	* @param pAddr The address to look for.
1440	* @param phFlowBb Where to store the basic block handle on success.
1441	*/
1442	VMMR3DECL(int) DBGFR3FlowQueryBbByAddress(DBGFFLOW hFlow, PDBGFADDRESS pAddr, PDBGFFLOWBB phFlowBb)
1443	{
1444	PDBGFFLOWINT pThis = hFlow;
1445	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
1446	AssertPtrReturn(pAddr, VERR_INVALID_POINTER);
1447	AssertPtrReturn(phFlowBb, VERR_INVALID_POINTER);
1448
1449	PDBGFFLOWBBINT pFlowBb = NULL;
1450	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
1451	{
1452	if (dbgfR3FlowAddrIntersect(pFlowBb, pAddr))
1453	{
1454	DBGFR3FlowBbRetain(pFlowBb);
1455	*phFlowBb = pFlowBb;
1456	return VINF_SUCCESS;
1457	}
1458	}
1459
1460	return VERR_NOT_FOUND;
1461	}
1462
1463
1464	/**
1465	* Queries a branch table in the given control flow graph by the given address.
1466	*
1467	* @returns VBox status code.
1468	* @retval VERR_NOT_FOUND if there is no branch table with the given address.
1469	* @param hFlow The control flow graph handle.
1470	* @param pAddr The address of the branch table.
1471	* @param phFlowBranchTbl Where to store the handle to branch table on success.
1472	*
1473	* @note Call DBGFR3FlowBranchTblRelease() when the handle is not required anymore.
1474	*/
1475	VMMR3DECL(int) DBGFR3FlowQueryBranchTblByAddress(DBGFFLOW hFlow, PDBGFADDRESS pAddr, PDBGFFLOWBRANCHTBL phFlowBranchTbl)
1476	{
1477	PDBGFFLOWINT pThis = hFlow;
1478	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
1479	AssertPtrReturn(pAddr, VERR_INVALID_POINTER);
1480	AssertPtrReturn(phFlowBranchTbl, VERR_INVALID_POINTER);
1481
1482	PDBGFFLOWBRANCHTBLINT pBranchTbl = dbgfR3FlowBranchTblFindByAddr(pThis, pAddr);
1483	if (pBranchTbl)
1484	{
1485	DBGFR3FlowBranchTblRetain(pBranchTbl);
1486	*phFlowBranchTbl = pBranchTbl;
1487	return VINF_SUCCESS;
1488	}
1489
1490	return VERR_NOT_FOUND;
1491	}
1492
1493
1494	/**
1495	* Returns the number of basic blcoks inside the control flow graph.
1496	*
1497	* @returns Number of basic blocks.
1498	* @param hFlow The control flow graph handle.
1499	*/
1500	VMMR3DECL(uint32_t) DBGFR3FlowGetBbCount(DBGFFLOW hFlow)
1501	{
1502	PDBGFFLOWINT pThis = hFlow;
1503	AssertPtrReturn(pThis, 0);
1504
1505	return pThis->cBbs;
1506	}
1507
1508
1509	/**
1510	* Retains the basic block handle.
1511	*
1512	* @returns Current reference count.
1513	* @param hFlowBb The basic block handle to retain.
1514	*/
1515	VMMR3DECL(uint32_t) DBGFR3FlowBbRetain(DBGFFLOWBB hFlowBb)
1516	{
1517	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1518	AssertPtrReturn(pFlowBb, UINT32_MAX);
1519
1520	uint32_t cRefs = ASMAtomicIncU32(&pFlowBb->cRefs);
1521	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p %d\n", cRefs, pFlowBb, pFlowBb->enmEndType));
1522	return cRefs;
1523	}
1524
1525
1526	/**
1527	* Releases the basic block handle.
1528	*
1529	* @returns Current reference count, on 0 the basic block will be destroyed.
1530	* @param hFlowBb The basic block handle to release.
1531	*/
1532	VMMR3DECL(uint32_t) DBGFR3FlowBbRelease(DBGFFLOWBB hFlowBb)
1533	{
1534	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1535	if (!pFlowBb)
1536	return 0;
1537
1538	return dbgfR3FlowBbReleaseInt(pFlowBb, true /* fMayDestroyFlow */);
1539	}
1540
1541
1542	/**
1543	* Returns the start address of the basic block.
1544	*
1545	* @returns Pointer to DBGF adress containing the start address of the basic block.
1546	* @param hFlowBb The basic block handle.
1547	* @param pAddrStart Where to store the start address of the basic block.
1548	*/
1549	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBbGetStartAddress(DBGFFLOWBB hFlowBb, PDBGFADDRESS pAddrStart)
1550	{
1551	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1552	AssertPtrReturn(pFlowBb, NULL);
1553	AssertPtrReturn(pAddrStart, NULL);
1554
1555	*pAddrStart = pFlowBb->AddrStart;
1556	return pAddrStart;
1557	}
1558
1559
1560	/**
1561	* Returns the end address of the basic block (inclusive).
1562	*
1563	* @returns Pointer to DBGF adress containing the end address of the basic block.
1564	* @param hFlowBb The basic block handle.
1565	* @param pAddrEnd Where to store the end address of the basic block.
1566	*/
1567	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBbGetEndAddress(DBGFFLOWBB hFlowBb, PDBGFADDRESS pAddrEnd)
1568	{
1569	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1570	AssertPtrReturn(pFlowBb, NULL);
1571	AssertPtrReturn(pAddrEnd, NULL);
1572
1573	*pAddrEnd = pFlowBb->AddrEnd;
1574	return pAddrEnd;
1575	}
1576
1577
1578	/**
1579	* Returns the address the last instruction in the basic block branches to.
1580	*
1581	* @returns Pointer to DBGF adress containing the branch address of the basic block.
1582	* @param hFlowBb The basic block handle.
1583	* @param pAddrTarget Where to store the branch address of the basic block.
1584	*
1585	* @note This is only valid for unconditional or conditional branches and will assert
1586	* for every other basic block type.
1587	*/
1588	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBbGetBranchAddress(DBGFFLOWBB hFlowBb, PDBGFADDRESS pAddrTarget)
1589	{
1590	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1591	AssertPtrReturn(pFlowBb, NULL);
1592	AssertPtrReturn(pAddrTarget, NULL);
1593	AssertReturn( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_JMP
1594	\|\| pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_COND,
1595	NULL);
1596
1597	*pAddrTarget = pFlowBb->AddrTarget;
1598	return pAddrTarget;
1599	}
1600
1601
1602	/**
1603	* Returns the address of the next block following this one in the instruction stream.
1604	* (usually end address + 1).
1605	*
1606	* @returns Pointer to DBGF adress containing the following address of the basic block.
1607	* @param hFlowBb The basic block handle.
1608	* @param pAddrFollow Where to store the following address of the basic block.
1609	*
1610	* @note This is only valid for conditional branches and if the last instruction in the
1611	* given basic block doesn't change the control flow but the blocks were split
1612	* because the successor is referenced by multiple other blocks as an entry point.
1613	*/
1614	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBbGetFollowingAddress(DBGFFLOWBB hFlowBb, PDBGFADDRESS pAddrFollow)
1615	{
1616	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1617	AssertPtrReturn(pFlowBb, NULL);
1618	AssertPtrReturn(pAddrFollow, NULL);
1619	AssertReturn( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND
1620	\|\| pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_COND,
1621	NULL);
1622
1623	*pAddrFollow = pFlowBb->AddrEnd;
1624	DBGFR3AddrAdd(pAddrFollow, 1);
1625	return pAddrFollow;
1626	}
1627
1628
1629	/**
1630	* Returns the type of the last instruction in the basic block.
1631	*
1632	* @returns Last instruction type.
1633	* @param hFlowBb The basic block handle.
1634	*/
1635	VMMR3DECL(DBGFFLOWBBENDTYPE) DBGFR3FlowBbGetType(DBGFFLOWBB hFlowBb)
1636	{
1637	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1638	AssertPtrReturn(pFlowBb, DBGFFLOWBBENDTYPE_INVALID);
1639
1640	return pFlowBb->enmEndType;
1641	}
1642
1643
1644	/**
1645	* Get the number of instructions contained in the basic block.
1646	*
1647	* @returns Number of instructions in the basic block.
1648	* @param hFlowBb The basic block handle.
1649	*/
1650	VMMR3DECL(uint32_t) DBGFR3FlowBbGetInstrCount(DBGFFLOWBB hFlowBb)
1651	{
1652	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1653	AssertPtrReturn(pFlowBb, 0);
1654
1655	return pFlowBb->cInstr;
1656	}
1657
1658
1659	/**
1660	* Get flags for the given basic block.
1661	*
1662	* @returns Combination of DBGF_FLOW_BB_F_*
1663	* @param hFlowBb The basic block handle.
1664	*/
1665	VMMR3DECL(uint32_t) DBGFR3FlowBbGetFlags(DBGFFLOWBB hFlowBb)
1666	{
1667	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1668	AssertPtrReturn(pFlowBb, 0);
1669
1670	return pFlowBb->fFlags;
1671	}
1672
1673
1674	/**
1675	* Queries the branch table used if the given basic block ends with an indirect branch
1676	* and has a branch table referenced.
1677	*
1678	* @returns VBox status code.
1679	* @param hFlowBb The basic block handle.
1680	* @param phBranchTbl Where to store the branch table handle on success.
1681	*
1682	* @note Release the branch table reference with DBGFR3FlowBranchTblRelease() when not required
1683	* anymore.
1684	*/
1685	VMMR3DECL(int) DBGFR3FlowBbQueryBranchTbl(DBGFFLOWBB hFlowBb, PDBGFFLOWBRANCHTBL phBranchTbl)
1686	{
1687	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1688	AssertPtrReturn(pFlowBb, VERR_INVALID_HANDLE);
1689	AssertReturn(pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_INDIRECT_JMP, VERR_INVALID_STATE);
1690	AssertPtrReturn(pFlowBb->pFlowBranchTbl, VERR_INVALID_STATE);
1691	AssertPtrReturn(phBranchTbl, VERR_INVALID_POINTER);
1692
1693	DBGFR3FlowBranchTblRetain(pFlowBb->pFlowBranchTbl);
1694	*phBranchTbl = pFlowBb->pFlowBranchTbl;
1695	return VINF_SUCCESS;
1696	}
1697
1698
1699	/**
1700	* Returns the error status and message if the given basic block has an error.
1701	*
1702	* @returns VBox status code of the error for the basic block.
1703	* @param hFlowBb The basic block handle.
1704	* @param ppszErr Where to store the pointer to the error message - optional.
1705	*/
1706	VMMR3DECL(int) DBGFR3FlowBbQueryError(DBGFFLOWBB hFlowBb, const char **ppszErr)
1707	{
1708	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1709	AssertPtrReturn(pFlowBb, VERR_INVALID_HANDLE);
1710
1711	if (ppszErr)
1712	*ppszErr = pFlowBb->pszErr;
1713
1714	return pFlowBb->rcError;
1715	}
1716
1717
1718	/**
1719	* Store the disassembled instruction as a string in the given output buffer.
1720	*
1721	* @returns VBox status code.
1722	* @param hFlowBb The basic block handle.
1723	* @param idxInstr The instruction to query.
1724	* @param pAddrInstr Where to store the guest instruction address on success, optional.
1725	* @param pcbInstr Where to store the instruction size on success, optional.
1726	* @param ppszInstr Where to store the pointer to the disassembled instruction string, optional.
1727	*/
1728	VMMR3DECL(int) DBGFR3FlowBbQueryInstr(DBGFFLOWBB hFlowBb, uint32_t idxInstr, PDBGFADDRESS pAddrInstr,
1729	uint32_t pcbInstr, const char *ppszInstr)
1730	{
1731	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1732	AssertPtrReturn(pFlowBb, VERR_INVALID_POINTER);
1733	AssertReturn(idxInstr < pFlowBb->cInstr, VERR_INVALID_PARAMETER);
1734
1735	if (pAddrInstr)
1736	*pAddrInstr = pFlowBb->aInstr[idxInstr].AddrInstr;
1737	if (pcbInstr)
1738	*pcbInstr = pFlowBb->aInstr[idxInstr].cbInstr;
1739	if (ppszInstr)
1740	*ppszInstr = pFlowBb->aInstr[idxInstr].pszInstr;
1741
1742	return VINF_SUCCESS;
1743	}
1744
1745
1746	/**
1747	* Queries the successors of the basic block.
1748	*
1749	* @returns VBox status code.
1750	* @param hFlowBb The basic block handle.
1751	* @param phFlowBbFollow Where to store the handle to the basic block following
1752	* this one (optional).
1753	* @param phFlowBbTarget Where to store the handle to the basic block being the
1754	* branch target for this one (optional).
1755	*/
1756	VMMR3DECL(int) DBGFR3FlowBbQuerySuccessors(DBGFFLOWBB hFlowBb, PDBGFFLOWBB phFlowBbFollow, PDBGFFLOWBB phFlowBbTarget)
1757	{
1758	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1759	AssertPtrReturn(pFlowBb, VERR_INVALID_POINTER);
1760
1761	if ( phFlowBbFollow
1762	&& ( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND
1763	\|\| pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_COND))
1764	{
1765	DBGFADDRESS AddrStart = pFlowBb->AddrEnd;
1766	DBGFR3AddrAdd(&AddrStart, 1);
1767	int rc = DBGFR3FlowQueryBbByAddress(pFlowBb->pFlow, &AddrStart, phFlowBbFollow);
1768	AssertRC(rc);
1769	}
1770
1771	if ( phFlowBbTarget
1772	&& ( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_JMP
1773	\|\| pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_COND))
1774	{
1775	int rc = DBGFR3FlowQueryBbByAddress(pFlowBb->pFlow, &pFlowBb->AddrTarget, phFlowBbTarget);
1776	AssertRC(rc);
1777	}
1778
1779	return VINF_SUCCESS;
1780	}
1781
1782
1783	/**
1784	* Returns the number of basic blocks referencing this basic block as a target.
1785	*
1786	* @returns Number of other basic blocks referencing this one.
1787	* @param hFlowBb The basic block handle.
1788	*
1789	* @note If the given basic block references itself (loop, etc.) this will be counted as well.
1790	*/
1791	VMMR3DECL(uint32_t) DBGFR3FlowBbGetRefBbCount(DBGFFLOWBB hFlowBb)
1792	{
1793	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1794	AssertPtrReturn(pFlowBb, 0);
1795
1796	uint32_t cRefsBb = 0;
1797	PDBGFFLOWBBINT pFlowBbCur = NULL;
1798	RTListForEach(&pFlowBb->pFlow->LstFlowBb, pFlowBbCur, DBGFFLOWBBINT, NdFlowBb)
1799	{
1800	if (pFlowBbCur->fFlags & DBGF_FLOW_BB_F_INCOMPLETE_ERR)
1801	continue;
1802
1803	if ( pFlowBbCur->enmEndType == DBGFFLOWBBENDTYPE_UNCOND
1804	\|\| pFlowBbCur->enmEndType == DBGFFLOWBBENDTYPE_COND)
1805	{
1806	DBGFADDRESS AddrStart = pFlowBb->AddrEnd;
1807	DBGFR3AddrAdd(&AddrStart, 1);
1808	if (dbgfR3FlowAddrEqual(&pFlowBbCur->AddrStart, &AddrStart))
1809	cRefsBb++;
1810	}
1811
1812	if ( ( pFlowBbCur->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_JMP
1813	\|\| pFlowBbCur->enmEndType == DBGFFLOWBBENDTYPE_COND)
1814	&& dbgfR3FlowAddrEqual(&pFlowBbCur->AddrStart, &pFlowBb->AddrTarget))
1815	cRefsBb++;
1816	}
1817	return cRefsBb;
1818	}
1819
1820
1821	/**
1822	* Returns the basic block handles referencing the given basic block.
1823	*
1824	* @returns VBox status code.
1825	* @retval VERR_BUFFER_OVERFLOW if the array can't hold all the basic blocks.
1826	* @param hFlowBb The basic block handle.
1827	* @param paFlowBbRef Pointer to the array containing the referencing basic block handles on success.
1828	* @param cRef Number of entries in the given array.
1829	*/
1830	VMMR3DECL(int) DBGFR3FlowBbGetRefBb(DBGFFLOWBB hFlowBb, PDBGFFLOWBB paFlowBbRef, uint32_t cRef)
1831	{
1832	RT_NOREF3(hFlowBb, paFlowBbRef, cRef);
1833	return VERR_NOT_IMPLEMENTED;
1834	}
1835
1836
1837	/**
1838	* Retains a reference for the given control flow graph branch table.
1839	*
1840	* @returns new reference count.
1841	* @param hFlowBranchTbl The branch table handle.
1842	*/
1843	VMMR3DECL(uint32_t) DBGFR3FlowBranchTblRetain(DBGFFLOWBRANCHTBL hFlowBranchTbl)
1844	{
1845	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
1846	AssertPtrReturn(pFlowBranchTbl, UINT32_MAX);
1847
1848	uint32_t cRefs = ASMAtomicIncU32(&pFlowBranchTbl->cRefs);
1849	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pFlowBranchTbl));
1850	return cRefs;
1851	}
1852
1853
1854	/**
1855	* Releases a given branch table handle.
1856	*
1857	* @returns the new reference count of the given branch table, on 0 it is destroyed.
1858	* @param hFlowBranchTbl The branch table handle.
1859	*/
1860	VMMR3DECL(uint32_t) DBGFR3FlowBranchTblRelease(DBGFFLOWBRANCHTBL hFlowBranchTbl)
1861	{
1862	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
1863	if (!pFlowBranchTbl)
1864	return 0;
1865	AssertPtrReturn(pFlowBranchTbl, UINT32_MAX);
1866
1867	uint32_t cRefs = ASMAtomicDecU32(&pFlowBranchTbl->cRefs);
1868	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pFlowBranchTbl));
1869	if (cRefs == 0)
1870	dbgfR3FlowBranchTblDestroy(pFlowBranchTbl);
1871	return cRefs;
1872	}
1873
1874
1875	/**
1876	* Return the number of slots the branch table has.
1877	*
1878	* @returns Number of slots in the branch table.
1879	* @param hFlowBranchTbl The branch table handle.
1880	*/
1881	VMMR3DECL(uint32_t) DBGFR3FlowBranchTblGetSlots(DBGFFLOWBRANCHTBL hFlowBranchTbl)
1882	{
1883	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
1884	AssertPtrReturn(pFlowBranchTbl, 0);
1885
1886	return pFlowBranchTbl->cSlots;
1887	}
1888
1889
1890	/**
1891	* Returns the start address of the branch table in the guest.
1892	*
1893	* @returns Pointer to start address of the branch table (pAddrStart).
1894	* @param hFlowBranchTbl The branch table handle.
1895	* @param pAddrStart Where to store the branch table address.
1896	*/
1897	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBranchTblGetStartAddress(DBGFFLOWBRANCHTBL hFlowBranchTbl, PDBGFADDRESS pAddrStart)
1898	{
1899	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
1900	AssertPtrReturn(pFlowBranchTbl, NULL);
1901	AssertPtrReturn(pAddrStart, NULL);
1902
1903	*pAddrStart = pFlowBranchTbl->AddrStart;
1904	return pAddrStart;
1905	}
1906
1907
1908	/**
1909	* Query all addresses contained in the given branch table.
1910	*
1911	* @returns VBox status code.
1912	* @retval VERR_BUFFER_OVERFLOW if there is not enough space in the array to hold all addresses.
1913	* @param hFlowBranchTbl The branch table handle.
1914	* @param paAddrs Where to store the addresses on success.
1915	* @param cAddrs Number of entries the array can hold.
1916	*/
1917	VMMR3DECL(int) DBGFR3FlowBranchTblQueryAddresses(DBGFFLOWBRANCHTBL hFlowBranchTbl, PDBGFADDRESS paAddrs, uint32_t cAddrs)
1918	{
1919	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
1920	AssertPtrReturn(pFlowBranchTbl, VERR_INVALID_HANDLE);
1921	AssertPtrReturn(paAddrs, VERR_INVALID_POINTER);
1922	AssertReturn(cAddrs > 0, VERR_INVALID_PARAMETER);
1923
1924	if (cAddrs < pFlowBranchTbl->cSlots)
1925	return VERR_BUFFER_OVERFLOW;
1926
1927	memcpy(paAddrs, &pFlowBranchTbl->aAddresses[0], pFlowBranchTbl->cSlots * sizeof(DBGFADDRESS));
1928	return VINF_SUCCESS;
1929	}
1930
1931
1932	/**
1933	* @callback_method_impl{FNRTSORTCMP}
1934	*/
1935	static DECLCALLBACK(int) dbgfR3FlowItSortCmp(void const pvElement1, void const pvElement2, void *pvUser)
1936	{
1937	PDBGFFLOWITORDER penmOrder = (PDBGFFLOWITORDER)pvUser;
1938	PDBGFFLOWBBINT pFlowBb1 = (PDBGFFLOWBBINT )pvElement1;
1939	PDBGFFLOWBBINT pFlowBb2 = (PDBGFFLOWBBINT )pvElement2;
1940
1941	if (dbgfR3FlowAddrEqual(&pFlowBb1->AddrStart, &pFlowBb2->AddrStart))
1942	return 0;
1943
1944	if (*penmOrder == DBGFFLOWITORDER_BY_ADDR_LOWEST_FIRST)
1945	{
1946	if (dbgfR3FlowAddrLower(&pFlowBb1->AddrStart, &pFlowBb2->AddrStart))
1947	return -1;
1948	else
1949	return 1;
1950	}
1951	else
1952	{
1953	if (dbgfR3FlowAddrLower(&pFlowBb1->AddrStart, &pFlowBb2->AddrStart))
1954	return 1;
1955	else
1956	return -1;
1957	}
1958	}
1959
1960
1961	/**
1962	* Creates a new iterator for the given control flow graph.
1963	*
1964	* @returns VBox status code.
1965	* @param hFlow The control flow graph handle.
1966	* @param enmOrder The order in which the basic blocks are enumerated.
1967	* @param phFlowIt Where to store the handle to the iterator on success.
1968	*/
1969	VMMR3DECL(int) DBGFR3FlowItCreate(DBGFFLOW hFlow, DBGFFLOWITORDER enmOrder, PDBGFFLOWIT phFlowIt)
1970	{
1971	int rc = VINF_SUCCESS;
1972	PDBGFFLOWINT pFlow = hFlow;
1973	AssertPtrReturn(pFlow, VERR_INVALID_POINTER);
1974	AssertPtrReturn(phFlowIt, VERR_INVALID_POINTER);
1975	AssertReturn(enmOrder > DBGFFLOWITORDER_INVALID && enmOrder < DBGFFLOWITORDER_BREADTH_FIRST,
1976	VERR_INVALID_PARAMETER);
1977	AssertReturn(enmOrder < DBGFFLOWITORDER_DEPTH_FRIST, VERR_NOT_IMPLEMENTED); /** @todo */
1978
1979	PDBGFFLOWITINT pIt = (PDBGFFLOWITINT)RTMemAllocZ(RT_OFFSETOF(DBGFFLOWITINT, apBb[pFlow->cBbs]));
1980	if (RT_LIKELY(pIt))
1981	{
1982	DBGFR3FlowRetain(hFlow);
1983	pIt->pFlow = pFlow;
1984	pIt->idxBbNext = 0;
1985	/* Fill the list and then sort. */
1986	PDBGFFLOWBBINT pFlowBb;
1987	uint32_t idxBb = 0;
1988	RTListForEach(&pFlow->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
1989	{
1990	DBGFR3FlowBbRetain(pFlowBb);
1991	pIt->apBb[idxBb++] = pFlowBb;
1992	}
1993
1994	/* Sort the blocks by address. */
1995	RTSortShell(&pIt->apBb[0], pFlow->cBbs, sizeof(PDBGFFLOWBBINT), dbgfR3FlowItSortCmp, &enmOrder);
1996
1997	*phFlowIt = pIt;
1998	}
1999	else
2000	rc = VERR_NO_MEMORY;
2001
2002	return rc;
2003	}
2004
2005
2006	/**
2007	* Destroys a given control flow graph iterator.
2008	*
2009	* @returns nothing.
2010	* @param hFlowIt The control flow graph iterator handle.
2011	*/
2012	VMMR3DECL(void) DBGFR3FlowItDestroy(DBGFFLOWIT hFlowIt)
2013	{
2014	PDBGFFLOWITINT pIt = hFlowIt;
2015	AssertPtrReturnVoid(pIt);
2016
2017	for (unsigned i = 0; i < pIt->pFlow->cBbs; i++)
2018	DBGFR3FlowBbRelease(pIt->apBb[i]);
2019
2020	DBGFR3FlowRelease(pIt->pFlow);
2021	RTMemFree(pIt);
2022	}
2023
2024
2025	/**
2026	* Returns the next basic block in the iterator or NULL if there is no
2027	* basic block left.
2028	*
2029	* @returns Handle to the next basic block in the iterator or NULL if the end
2030	* was reached.
2031	* @param hFlowIt The iterator handle.
2032	*
2033	* @note If a valid handle is returned it must be release with DBGFR3FlowBbRelease()
2034	* when not required anymore.
2035	*/
2036	VMMR3DECL(DBGFFLOWBB) DBGFR3FlowItNext(DBGFFLOWIT hFlowIt)
2037	{
2038	PDBGFFLOWITINT pIt = hFlowIt;
2039	AssertPtrReturn(pIt, NULL);
2040
2041	PDBGFFLOWBBINT pFlowBb = NULL;
2042	if (pIt->idxBbNext < pIt->pFlow->cBbs)
2043	{
2044	pFlowBb = pIt->apBb[pIt->idxBbNext++];
2045	DBGFR3FlowBbRetain(pFlowBb);
2046	}
2047
2048	return pFlowBb;
2049	}
2050
2051
2052	/**
2053	* Resets the given iterator to the beginning.
2054	*
2055	* @returns VBox status code.
2056	* @param hFlowIt The iterator handle.
2057	*/
2058	VMMR3DECL(int) DBGFR3FlowItReset(DBGFFLOWIT hFlowIt)
2059	{
2060	PDBGFFLOWITINT pIt = hFlowIt;
2061	AssertPtrReturn(pIt, VERR_INVALID_HANDLE);
2062
2063	pIt->idxBbNext = 0;
2064	return VINF_SUCCESS;
2065	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3Flow.cpp@ 64586

Download in other formats: