DBGFR3Flow.cpp@ 98103

Last change on this file since 98103 was 98103, checked in by vboxsync, 23 months ago
Copyright year updates by scm.
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 83.1 KB

Line
1	/* $Id: DBGFR3Flow.cpp 98103 2023-01-17 14:15:46Z vboxsync $ */
2	/** @file
3	* DBGF - Debugger Facility, Control Flow Graph Interface (CFG).
4	*/
5
6	/*
7	* Copyright (C) 2016-2023 Oracle and/or its affiliates.
8	*
9	* This file is part of VirtualBox base platform packages, as
10	* available from https://www.virtualbox.org.
11	*
12	* This program is free software; you can redistribute it and/or
13	* modify it under the terms of the GNU General Public License
14	* as published by the Free Software Foundation, in version 3 of the
15	* License.
16	*
17	* This program is distributed in the hope that it will be useful, but
18	* WITHOUT ANY WARRANTY; without even the implied warranty of
19	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20	* General Public License for more details.
21	*
22	* You should have received a copy of the GNU General Public License
23	* along with this program; if not, see <https://www.gnu.org/licenses>.
24	*
25	* SPDX-License-Identifier: GPL-3.0-only
26	*/
27
28
29	/** @page pg_dbgf_cfg DBGFR3Flow - Control Flow Graph Interface
30	*
31	* The control flow graph interface provides an API to disassemble
32	* guest code providing the result in a control flow graph.
33	*/
34
35
36	/*********************************************************************************************************************************
37	* Header Files *
38	*********************************************************************************************************************************/
39	#define LOG_GROUP LOG_GROUP_DBGF
40	#include <VBox/vmm/dbgf.h>
41	#include "DBGFInternal.h"
42	#include <VBox/vmm/mm.h>
43	#include <VBox/vmm/uvm.h>
44	#include <VBox/vmm/vm.h>
45	#include <VBox/err.h>
46	#include <VBox/log.h>
47
48	#include <iprt/assert.h>
49	#include <iprt/thread.h>
50	#include <iprt/param.h>
51	#include <iprt/list.h>
52	#include <iprt/mem.h>
53	#include <iprt/sort.h>
54	#include <iprt/strcache.h>
55
56
57	/*********************************************************************************************************************************
58	* Structures and Typedefs *
59	*********************************************************************************************************************************/
60
61	/**
62	* Internal control flow graph state.
63	*/
64	typedef struct DBGFFLOWINT
65	{
66	/** Reference counter. */
67	uint32_t volatile cRefs;
68	/** Internal reference counter for basic blocks. */
69	uint32_t volatile cRefsBb;
70	/** Flags during creation. */
71	uint32_t fFlags;
72	/** List of all basic blocks. */
73	RTLISTANCHOR LstFlowBb;
74	/** List of identified branch tables. */
75	RTLISTANCHOR LstBranchTbl;
76	/** Number of basic blocks in this control flow graph. */
77	uint32_t cBbs;
78	/** Number of branch tables in this control flow graph. */
79	uint32_t cBranchTbls;
80	/** Number of call instructions in this control flow graph. */
81	uint32_t cCallInsns;
82	/** The lowest addres of a basic block. */
83	DBGFADDRESS AddrLowest;
84	/** The highest address of a basic block. */
85	DBGFADDRESS AddrHighest;
86	/** String cache for disassembled instructions. */
87	RTSTRCACHE hStrCacheInstr;
88	} DBGFFLOWINT;
89	/** Pointer to an internal control flow graph state. */
90	typedef DBGFFLOWINT *PDBGFFLOWINT;
91
92	/**
93	* Instruction record
94	*/
95	typedef struct DBGFFLOWBBINSTR
96	{
97	/** Instruction address. */
98	DBGFADDRESS AddrInstr;
99	/** Size of instruction. */
100	uint32_t cbInstr;
101	/** Disassembled instruction string. */
102	const char *pszInstr;
103	} DBGFFLOWBBINSTR;
104	/** Pointer to an instruction record. */
105	typedef DBGFFLOWBBINSTR *PDBGFFLOWBBINSTR;
106
107
108	/**
109	* A branch table identified by the graph processor.
110	*/
111	typedef struct DBGFFLOWBRANCHTBLINT
112	{
113	/** Node for the list of branch tables. */
114	RTLISTNODE NdBranchTbl;
115	/** The owning control flow graph. */
116	PDBGFFLOWINT pFlow;
117	/** Reference counter. */
118	uint32_t volatile cRefs;
119	/** The general register index holding the bracnh table base. */
120	uint8_t idxGenRegBase;
121	/** Start address of the branch table. */
122	DBGFADDRESS AddrStart;
123	/** Number of valid entries in the branch table. */
124	uint32_t cSlots;
125	/** The addresses contained in the branch table - variable in size. */
126	DBGFADDRESS aAddresses[1];
127	} DBGFFLOWBRANCHTBLINT;
128	/** Pointer to a branch table structure. */
129	typedef DBGFFLOWBRANCHTBLINT *PDBGFFLOWBRANCHTBLINT;
130
131
132	/**
133	* Internal control flow graph basic block state.
134	*/
135	typedef struct DBGFFLOWBBINT
136	{
137	/** Node for the list of all basic blocks. */
138	RTLISTNODE NdFlowBb;
139	/** The control flow graph the basic block belongs to. */
140	PDBGFFLOWINT pFlow;
141	/** Reference counter. */
142	uint32_t volatile cRefs;
143	/** Basic block end type. */
144	DBGFFLOWBBENDTYPE enmEndType;
145	/** Start address of this basic block. */
146	DBGFADDRESS AddrStart;
147	/** End address of this basic block. */
148	DBGFADDRESS AddrEnd;
149	/** Address of the block succeeding.
150	* This is valid for conditional jumps
151	* (the other target is referenced by AddrEnd+1) and
152	* unconditional jumps (not ret, iret, etc.) except
153	* if we can't infer the jump target (jmp eax for example). /
154	DBGFADDRESS AddrTarget;
155	/** The indirect branch table identified for indirect branches. */
156	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl;
157	/** Last status error code if DBGF_FLOW_BB_F_INCOMPLETE_ERR is set. */
158	int rcError;
159	/** Error message if DBGF_FLOW_BB_F_INCOMPLETE_ERR is set. */
160	char *pszErr;
161	/** Flags for this basic block. */
162	uint32_t fFlags;
163	/** Number of instructions in this basic block. */
164	uint32_t cInstr;
165	/** Maximum number of instruction records for this basic block. */
166	uint32_t cInstrMax;
167	/** Instruction records, variable in size. */
168	DBGFFLOWBBINSTR aInstr[1];
169	} DBGFFLOWBBINT;
170	/** Pointer to an internal control flow graph basic block state. */
171	typedef DBGFFLOWBBINT *PDBGFFLOWBBINT;
172
173
174	/**
175	* Control flow graph iterator state.
176	*/
177	typedef struct DBGFFLOWITINT
178	{
179	/** Pointer to the control flow graph (holding a reference). */
180	PDBGFFLOWINT pFlow;
181	/** Next basic block to return. */
182	uint32_t idxBbNext;
183	/** Array of basic blocks sorted by the specified order - variable in size. */
184	PDBGFFLOWBBINT apBb[1];
185	} DBGFFLOWITINT;
186	/** Pointer to the internal control flow graph iterator state. */
187	typedef DBGFFLOWITINT *PDBGFFLOWITINT;
188
189
190	/**
191	* Control flow graph branch table iterator state.
192	*/
193	typedef struct DBGFFLOWBRANCHTBLITINT
194	{
195	/** Pointer to the control flow graph (holding a reference). */
196	PDBGFFLOWINT pFlow;
197	/** Next branch table to return. */
198	uint32_t idxTblNext;
199	/** Array of branch table pointers sorted by the specified order - variable in size. */
200	PDBGFFLOWBRANCHTBLINT apBranchTbl[1];
201	} DBGFFLOWBRANCHTBLITINT;
202	/** Pointer to the internal control flow graph branch table iterator state. */
203	typedef DBGFFLOWBRANCHTBLITINT *PDBGFFLOWBRANCHTBLITINT;
204
205
206	/*********************************************************************************************************************************
207	* Internal Functions *
208	*********************************************************************************************************************************/
209
210	static uint32_t dbgfR3FlowBbReleaseInt(PDBGFFLOWBBINT pFlowBb, bool fMayDestroyFlow);
211	static void dbgfR3FlowBranchTblDestroy(PDBGFFLOWBRANCHTBLINT pFlowBranchTbl);
212
213
214	/**
215	* Checks whether both addresses are equal.
216	*
217	* @returns true if both addresses point to the same location, false otherwise.
218	* @param pAddr1 First address.
219	* @param pAddr2 Second address.
220	*/
221	static bool dbgfR3FlowAddrEqual(PDBGFADDRESS pAddr1, PDBGFADDRESS pAddr2)
222	{
223	return pAddr1->Sel == pAddr2->Sel
224	&& pAddr1->off == pAddr2->off;
225	}
226
227
228	/**
229	* Checks whether the first given address is lower than the second one.
230	*
231	* @returns true if both addresses point to the same location, false otherwise.
232	* @param pAddr1 First address.
233	* @param pAddr2 Second address.
234	*/
235	static bool dbgfR3FlowAddrLower(PDBGFADDRESS pAddr1, PDBGFADDRESS pAddr2)
236	{
237	return pAddr1->Sel == pAddr2->Sel
238	&& pAddr1->off < pAddr2->off;
239	}
240
241
242	/**
243	* Checks whether the given basic block and address intersect.
244	*
245	* @returns true if they intersect, false otherwise.
246	* @param pFlowBb The basic block to check.
247	* @param pAddr The address to check for.
248	*/
249	static bool dbgfR3FlowAddrIntersect(PDBGFFLOWBBINT pFlowBb, PDBGFADDRESS pAddr)
250	{
251	return (pFlowBb->AddrStart.Sel == pAddr->Sel)
252	&& (pFlowBb->AddrStart.off <= pAddr->off)
253	&& (pFlowBb->AddrEnd.off >= pAddr->off);
254	}
255
256
257	/**
258	* Returns the distance of the two given addresses.
259	*
260	* @returns Distance of the addresses.
261	* @param pAddr1 The first address.
262	* @param pAddr2 The second address.
263	*/
264	static RTGCUINTPTR dbgfR3FlowAddrGetDistance(PDBGFADDRESS pAddr1, PDBGFADDRESS pAddr2)
265	{
266	if (pAddr1->Sel == pAddr2->Sel)
267	{
268	if (pAddr1->off >= pAddr2->off)
269	return pAddr1->off - pAddr2->off;
270	else
271	return pAddr2->off - pAddr1->off;
272	}
273	else
274	AssertFailed();
275
276	return 0;
277	}
278
279
280	/**
281	* Creates a new basic block.
282	*
283	* @returns Pointer to the basic block on success or NULL if out of memory.
284	* @param pThis The control flow graph.
285	* @param pAddrStart The start of the basic block.
286	* @param fFlowBbFlags Additional flags for this bascic block.
287	* @param cInstrMax Maximum number of instructions this block can hold initially.
288	*/
289	static PDBGFFLOWBBINT dbgfR3FlowBbCreate(PDBGFFLOWINT pThis, PDBGFADDRESS pAddrStart, uint32_t fFlowBbFlags,
290	uint32_t cInstrMax)
291	{
292	PDBGFFLOWBBINT pFlowBb = (PDBGFFLOWBBINT)RTMemAllocZ(RT_UOFFSETOF_DYN(DBGFFLOWBBINT, aInstr[cInstrMax]));
293	if (RT_LIKELY(pFlowBb))
294	{
295	RTListInit(&pFlowBb->NdFlowBb);
296	pFlowBb->cRefs = 1;
297	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_INVALID;
298	pFlowBb->pFlow = pThis;
299	pFlowBb->fFlags = DBGF_FLOW_BB_F_EMPTY \| fFlowBbFlags;
300	pFlowBb->AddrStart = *pAddrStart;
301	pFlowBb->AddrEnd = *pAddrStart;
302	pFlowBb->rcError = VINF_SUCCESS;
303	pFlowBb->pszErr = NULL;
304	pFlowBb->cInstr = 0;
305	pFlowBb->cInstrMax = cInstrMax;
306	pFlowBb->pFlowBranchTbl = NULL;
307	ASMAtomicIncU32(&pThis->cRefsBb);
308	}
309
310	return pFlowBb;
311	}
312
313
314	/**
315	* Creates an empty branch table with the given size.
316	*
317	* @returns Pointer to the empty branch table on success or NULL if out of memory.
318	* @param pThis The control flow graph.
319	* @param pAddrStart The start of the branch table.
320	* @param idxGenRegBase The general register index holding the base address.
321	* @param cSlots Number of slots the table has.
322	*/
323	static PDBGFFLOWBRANCHTBLINT
324	dbgfR3FlowBranchTblCreate(PDBGFFLOWINT pThis, PDBGFADDRESS pAddrStart, uint8_t idxGenRegBase, uint32_t cSlots)
325	{
326	PDBGFFLOWBRANCHTBLINT pBranchTbl = (PDBGFFLOWBRANCHTBLINT)RTMemAllocZ(RT_UOFFSETOF_DYN(DBGFFLOWBRANCHTBLINT,
327	aAddresses[cSlots]));
328	if (RT_LIKELY(pBranchTbl))
329	{
330	RTListInit(&pBranchTbl->NdBranchTbl);
331	pBranchTbl->pFlow = pThis;
332	pBranchTbl->idxGenRegBase = idxGenRegBase;
333	pBranchTbl->AddrStart = *pAddrStart;
334	pBranchTbl->cSlots = cSlots;
335	pBranchTbl->cRefs = 1;
336	}
337
338	return pBranchTbl;
339	}
340
341
342	/**
343	* Destroys a control flow graph.
344	*
345	* @returns nothing.
346	* @param pThis The control flow graph to destroy.
347	*/
348	static void dbgfR3FlowDestroy(PDBGFFLOWINT pThis)
349	{
350	/* Defer destruction if there are still basic blocks referencing us. */
351	PDBGFFLOWBBINT pFlowBb;
352	PDBGFFLOWBBINT pFlowBbNext;
353	RTListForEachSafe(&pThis->LstFlowBb, pFlowBb, pFlowBbNext, DBGFFLOWBBINT, NdFlowBb)
354	{
355	dbgfR3FlowBbReleaseInt(pFlowBb, false /fMayDestroyFlow/);
356	}
357
358	Assert(!pThis->cRefs);
359	if (!pThis->cRefsBb)
360	{
361	/* Destroy the branch tables. */
362	PDBGFFLOWBRANCHTBLINT pTbl = NULL;
363	PDBGFFLOWBRANCHTBLINT pTblNext = NULL;
364	RTListForEachSafe(&pThis->LstBranchTbl, pTbl, pTblNext, DBGFFLOWBRANCHTBLINT, NdBranchTbl)
365	{
366	dbgfR3FlowBranchTblDestroy(pTbl);
367	}
368
369	RTStrCacheDestroy(pThis->hStrCacheInstr);
370	RTMemFree(pThis);
371	}
372	}
373
374
375	/**
376	* Destroys a basic block.
377	*
378	* @returns nothing.
379	* @param pFlowBb The basic block to destroy.
380	* @param fMayDestroyFlow Flag whether the control flow graph container
381	* should be destroyed when there is nothing referencing it.
382	*/
383	static void dbgfR3FlowBbDestroy(PDBGFFLOWBBINT pFlowBb, bool fMayDestroyFlow)
384	{
385	PDBGFFLOWINT pThis = pFlowBb->pFlow;
386
387	RTListNodeRemove(&pFlowBb->NdFlowBb);
388	pThis->cBbs--;
389	for (uint32_t idxInstr = 0; idxInstr < pFlowBb->cInstr; idxInstr++)
390	RTStrCacheRelease(pThis->hStrCacheInstr, pFlowBb->aInstr[idxInstr].pszInstr);
391	uint32_t cRefsBb = ASMAtomicDecU32(&pThis->cRefsBb);
392	RTMemFree(pFlowBb);
393
394	if (!cRefsBb && !pThis->cRefs && fMayDestroyFlow)
395	dbgfR3FlowDestroy(pThis);
396	}
397
398
399	/**
400	* Destroys a given branch table.
401	*
402	* @returns nothing.
403	* @param pFlowBranchTbl The flow branch table to destroy.
404	*/
405	static void dbgfR3FlowBranchTblDestroy(PDBGFFLOWBRANCHTBLINT pFlowBranchTbl)
406	{
407	RTListNodeRemove(&pFlowBranchTbl->NdBranchTbl);
408	RTMemFree(pFlowBranchTbl);
409	}
410
411
412	/**
413	* Internal basic block release worker.
414	*
415	* @returns New reference count of the released basic block, on 0
416	* it is destroyed.
417	* @param pFlowBb The basic block to release.
418	* @param fMayDestroyFlow Flag whether the control flow graph container
419	* should be destroyed when there is nothing referencing it.
420	*/
421	static uint32_t dbgfR3FlowBbReleaseInt(PDBGFFLOWBBINT pFlowBb, bool fMayDestroyFlow)
422	{
423	uint32_t cRefs = ASMAtomicDecU32(&pFlowBb->cRefs);
424	AssertMsg(cRefs < _1M, ("%#x %p %d\n", cRefs, pFlowBb, pFlowBb->enmEndType));
425	if (cRefs == 0)
426	dbgfR3FlowBbDestroy(pFlowBb, fMayDestroyFlow);
427	return cRefs;
428	}
429
430
431	/**
432	* Links the given basic block into the control flow graph.
433	*
434	* @returns nothing.
435	* @param pThis The control flow graph to link into.
436	* @param pFlowBb The basic block to link.
437	*/
438	DECLINLINE(void) dbgfR3FlowLink(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb)
439	{
440	RTListAppend(&pThis->LstFlowBb, &pFlowBb->NdFlowBb);
441	pThis->cBbs++;
442	}
443
444
445	/**
446	* Links the given branch table into the control flow graph.
447	*
448	* @returns nothing.
449	* @param pThis The control flow graph to link into.
450	* @param pBranchTbl The branch table to link.
451	*/
452	DECLINLINE(void) dbgfR3FlowBranchTblLink(PDBGFFLOWINT pThis, PDBGFFLOWBRANCHTBLINT pBranchTbl)
453	{
454	RTListAppend(&pThis->LstBranchTbl, &pBranchTbl->NdBranchTbl);
455	pThis->cBranchTbls++;
456	}
457
458
459	/**
460	* Returns the first unpopulated basic block of the given control flow graph.
461	*
462	* @returns The first unpopulated control flow graph or NULL if not found.
463	* @param pThis The control flow graph.
464	*/
465	DECLINLINE(PDBGFFLOWBBINT) dbgfR3FlowGetUnpopulatedBb(PDBGFFLOWINT pThis)
466	{
467	PDBGFFLOWBBINT pFlowBb;
468	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
469	{
470	if (pFlowBb->fFlags & DBGF_FLOW_BB_F_EMPTY)
471	return pFlowBb;
472	}
473
474	return NULL;
475	}
476
477
478	/**
479	* Returns the branch table with the given address if it exists.
480	*
481	* @returns Pointer to the branch table record or NULL if not found.
482	* @param pThis The control flow graph.
483	* @param pAddrTbl The branch table address.
484	*/
485	DECLINLINE(PDBGFFLOWBRANCHTBLINT) dbgfR3FlowBranchTblFindByAddr(PDBGFFLOWINT pThis, PDBGFADDRESS pAddrTbl)
486	{
487	PDBGFFLOWBRANCHTBLINT pTbl;
488	RTListForEach(&pThis->LstBranchTbl, pTbl, DBGFFLOWBRANCHTBLINT, NdBranchTbl)
489	{
490	if (dbgfR3FlowAddrEqual(&pTbl->AddrStart, pAddrTbl))
491	return pTbl;
492	}
493
494	return NULL;
495	}
496
497
498	/**
499	* Sets the given error status for the basic block.
500	*
501	* @returns nothing.
502	* @param pFlowBb The basic block causing the error.
503	* @param rcError The error to set.
504	* @param pszFmt Format string of the error description.
505	* @param ... Arguments for the format string.
506	*/
507	static void dbgfR3FlowBbSetError(PDBGFFLOWBBINT pFlowBb, int rcError, const char *pszFmt, ...)
508	{
509	va_list va;
510	va_start(va, pszFmt);
511
512	Assert(!(pFlowBb->fFlags & DBGF_FLOW_BB_F_INCOMPLETE_ERR));
513	pFlowBb->fFlags \|= DBGF_FLOW_BB_F_INCOMPLETE_ERR;
514	pFlowBb->fFlags &= ~DBGF_FLOW_BB_F_EMPTY;
515	pFlowBb->rcError = rcError;
516	pFlowBb->pszErr = RTStrAPrintf2V(pszFmt, va);
517	va_end(va);
518	}
519
520
521	/**
522	* Checks whether the given control flow graph contains a basic block
523	* with the given start address.
524	*
525	* @returns true if there is a basic block with the start address, false otherwise.
526	* @param pThis The control flow graph.
527	* @param pAddr The address to check for.
528	*/
529	static bool dbgfR3FlowHasBbWithStartAddr(PDBGFFLOWINT pThis, PDBGFADDRESS pAddr)
530	{
531	PDBGFFLOWBBINT pFlowBb;
532	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
533	{
534	if (dbgfR3FlowAddrEqual(&pFlowBb->AddrStart, pAddr))
535	return true;
536	}
537	return false;
538	}
539
540
541	/**
542	* Splits a given basic block into two at the given address.
543	*
544	* @returns VBox status code.
545	* @param pThis The control flow graph.
546	* @param pFlowBb The basic block to split.
547	* @param pAddr The address to split at.
548	*/
549	static int dbgfR3FlowBbSplit(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PDBGFADDRESS pAddr)
550	{
551	int rc = VINF_SUCCESS;
552	uint32_t idxInstrSplit;
553
554	/* If the block is empty it will get populated later so there is nothing to split,
555	* same if the start address equals. */
556	if ( pFlowBb->fFlags & DBGF_FLOW_BB_F_EMPTY
557	\|\| dbgfR3FlowAddrEqual(&pFlowBb->AddrStart, pAddr))
558	return VINF_SUCCESS;
559
560	/* Find the instruction to split at. */
561	for (idxInstrSplit = 1; idxInstrSplit < pFlowBb->cInstr; idxInstrSplit++)
562	if (dbgfR3FlowAddrEqual(&pFlowBb->aInstr[idxInstrSplit].AddrInstr, pAddr))
563	break;
564
565	Assert(idxInstrSplit > 0);
566
567	/*
568	* Given address might not be on instruction boundary, this is not supported
569	* so far and results in an error.
570	*/
571	if (idxInstrSplit < pFlowBb->cInstr)
572	{
573	/* Create new basic block. */
574	uint32_t cInstrNew = pFlowBb->cInstr - idxInstrSplit;
575	PDBGFFLOWBBINT pFlowBbNew = dbgfR3FlowBbCreate(pThis, &pFlowBb->aInstr[idxInstrSplit].AddrInstr,
576	0 /fFlowBbFlags/, cInstrNew);
577	if (pFlowBbNew)
578	{
579	/* Move instructions over. */
580	pFlowBbNew->cInstr = cInstrNew;
581	pFlowBbNew->AddrEnd = pFlowBb->AddrEnd;
582	pFlowBbNew->enmEndType = pFlowBb->enmEndType;
583	pFlowBbNew->AddrTarget = pFlowBb->AddrTarget;
584	pFlowBbNew->fFlags = pFlowBb->fFlags & ~DBGF_FLOW_BB_F_ENTRY;
585	pFlowBbNew->pFlowBranchTbl = pFlowBb->pFlowBranchTbl;
586	pFlowBb->pFlowBranchTbl = NULL;
587
588	/* Move any error to the new basic block and clear them in the old basic block. */
589	pFlowBbNew->rcError = pFlowBb->rcError;
590	pFlowBbNew->pszErr = pFlowBb->pszErr;
591	pFlowBb->rcError = VINF_SUCCESS;
592	pFlowBb->pszErr = NULL;
593	pFlowBb->fFlags &= ~DBGF_FLOW_BB_F_INCOMPLETE_ERR;
594
595	memcpy(&pFlowBbNew->aInstr[0], &pFlowBb->aInstr[idxInstrSplit], cInstrNew * sizeof(DBGFFLOWBBINSTR));
596	pFlowBb->cInstr = idxInstrSplit;
597	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND;
598	pFlowBb->AddrEnd = pFlowBb->aInstr[idxInstrSplit-1].AddrInstr;
599	pFlowBb->AddrTarget = pFlowBbNew->AddrStart;
600	DBGFR3AddrAdd(&pFlowBb->AddrEnd, pFlowBb->aInstr[idxInstrSplit-1].cbInstr - 1);
601	RT_BZERO(&pFlowBb->aInstr[idxInstrSplit], cInstrNew * sizeof(DBGFFLOWBBINSTR));
602
603	dbgfR3FlowLink(pThis, pFlowBbNew);
604	}
605	else
606	rc = VERR_NO_MEMORY;
607	}
608	else
609	AssertFailedStmt(rc = VERR_INVALID_STATE); /** @todo Proper status code. */
610
611	return rc;
612	}
613
614
615	/**
616	* Makes sure there is an successor at the given address splitting already existing
617	* basic blocks if they intersect.
618	*
619	* @returns VBox status code.
620	* @param pThis The control flow graph.
621	* @param pAddrSucc The guest address the new successor should start at.
622	* @param fNewBbFlags Flags for the new basic block.
623	* @param pBranchTbl Branch table candidate for this basic block.
624	*/
625	static int dbgfR3FlowBbSuccessorAdd(PDBGFFLOWINT pThis, PDBGFADDRESS pAddrSucc,
626	uint32_t fNewBbFlags, PDBGFFLOWBRANCHTBLINT pBranchTbl)
627	{
628	PDBGFFLOWBBINT pFlowBb;
629	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
630	{
631	/*
632	* The basic block must be split if it intersects with the given address
633	* and the start address does not equal the given one.
634	*/
635	if (dbgfR3FlowAddrIntersect(pFlowBb, pAddrSucc))
636	return dbgfR3FlowBbSplit(pThis, pFlowBb, pAddrSucc);
637	}
638
639	int rc = VINF_SUCCESS;
640	pFlowBb = dbgfR3FlowBbCreate(pThis, pAddrSucc, fNewBbFlags, 10);
641	if (pFlowBb)
642	{
643	pFlowBb->pFlowBranchTbl = pBranchTbl;
644	dbgfR3FlowLink(pThis, pFlowBb);
645	}
646	else
647	rc = VERR_NO_MEMORY;
648
649	return rc;
650	}
651
652
653	/**
654	* Returns whether the parameter indicates an indirect branch.
655	*
656	* @returns Flag whether this is an indirect branch.
657	* @param pDisParam The parameter from the disassembler.
658	*/
659	DECLINLINE(bool) dbgfR3FlowBranchTargetIsIndirect(PDISOPPARAM pDisParam)
660	{
661	bool fIndirect = true;
662
663	if ( pDisParam->fUse & (DISUSE_IMMEDIATE8 \| DISUSE_IMMEDIATE16 \| DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64)
664	\|\| pDisParam->fUse & (DISUSE_IMMEDIATE8_REL \| DISUSE_IMMEDIATE16_REL \| DISUSE_IMMEDIATE32_REL \| DISUSE_IMMEDIATE64_REL))
665	fIndirect = false;
666
667	return fIndirect;
668	}
669
670
671	/**
672	* Resolves the direct branch target address if possible from the given instruction address
673	* and instruction parameter.
674	*
675	* @returns VBox status code.
676	* @param pUVM The usermode VM handle.
677	* @param idCpu CPU id for resolving the address.
678	* @param pDisParam The parameter from the disassembler.
679	* @param pAddrInstr The instruction address.
680	* @param cbInstr Size of instruction in bytes.
681	* @param fRelJmp Flag whether this is a reltive jump.
682	* @param pAddrJmpTarget Where to store the address to the jump target on success.
683	*/
684	static int dbgfR3FlowQueryDirectBranchTarget(PUVM pUVM, VMCPUID idCpu, PDISOPPARAM pDisParam, PDBGFADDRESS pAddrInstr,
685	uint32_t cbInstr, bool fRelJmp, PDBGFADDRESS pAddrJmpTarget)
686	{
687	int rc = VINF_SUCCESS;
688
689	Assert(!dbgfR3FlowBranchTargetIsIndirect(pDisParam));
690
691	/* Relative jumps are always from the beginning of the next instruction. */
692	pAddrJmpTarget = pAddrInstr;
693	DBGFR3AddrAdd(pAddrJmpTarget, cbInstr);
694
695	if (fRelJmp)
696	{
697	RTGCINTPTR iRel = 0;
698	if (pDisParam->fUse & DISUSE_IMMEDIATE8_REL)
699	iRel = (int8_t)pDisParam->uValue;
700	else if (pDisParam->fUse & DISUSE_IMMEDIATE16_REL)
701	iRel = (int16_t)pDisParam->uValue;
702	else if (pDisParam->fUse & DISUSE_IMMEDIATE32_REL)
703	iRel = (int32_t)pDisParam->uValue;
704	else if (pDisParam->fUse & DISUSE_IMMEDIATE64_REL)
705	iRel = (int64_t)pDisParam->uValue;
706	else
707	AssertFailedStmt(rc = VERR_NOT_SUPPORTED);
708
709	if (iRel < 0)
710	DBGFR3AddrSub(pAddrJmpTarget, -iRel);
711	else
712	DBGFR3AddrAdd(pAddrJmpTarget, iRel);
713	}
714	else
715	{
716	if (pDisParam->fUse & (DISUSE_IMMEDIATE8 \| DISUSE_IMMEDIATE16 \| DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64))
717	{
718	if (DBGFADDRESS_IS_FLAT(pAddrInstr))
719	DBGFR3AddrFromFlat(pUVM, pAddrJmpTarget, pDisParam->uValue);
720	else
721	DBGFR3AddrFromSelOff(pUVM, idCpu, pAddrJmpTarget, pAddrInstr->Sel, pDisParam->uValue);
722	}
723	else
724	AssertFailedStmt(rc = VERR_INVALID_STATE);
725	}
726
727	return rc;
728	}
729
730
731	/**
732	* Returns the CPU mode based on the given assembler flags.
733	*
734	* @returns CPU mode.
735	* @param pUVM The user mode VM handle.
736	* @param idCpu CPU id for disassembling.
737	* @param fFlagsDisasm The flags used for disassembling.
738	*/
739	static CPUMMODE dbgfR3FlowGetDisasCpuMode(PUVM pUVM, VMCPUID idCpu, uint32_t fFlagsDisasm)
740	{
741	CPUMMODE enmMode = CPUMMODE_INVALID;
742	uint32_t fDisasMode = fFlagsDisasm & DBGF_DISAS_FLAGS_MODE_MASK;
743	if (fDisasMode == DBGF_DISAS_FLAGS_DEFAULT_MODE)
744	enmMode = DBGFR3CpuGetMode(pUVM, idCpu);
745	else if ( fDisasMode == DBGF_DISAS_FLAGS_16BIT_MODE
746	\|\| fDisasMode == DBGF_DISAS_FLAGS_16BIT_REAL_MODE)
747	enmMode = CPUMMODE_REAL;
748	else if (fDisasMode == DBGF_DISAS_FLAGS_32BIT_MODE)
749	enmMode = CPUMMODE_PROTECTED;
750	else if (fDisasMode == DBGF_DISAS_FLAGS_64BIT_MODE)
751	enmMode = CPUMMODE_LONG;
752	else
753	AssertFailed();
754
755	return enmMode;
756	}
757
758
759	/**
760	* Searches backwards in the given basic block starting the given instruction index for
761	* a mov instruction with the given register as the target where the constant looks like
762	* a pointer.
763	*
764	* @returns Flag whether a candidate was found.
765	* @param pFlowBb The basic block containing the indirect branch.
766	* @param idxRegTgt The general register the mov targets.
767	* @param cbPtr The pointer size to look for.
768	* @param pUVM The user mode VM handle.
769	* @param idCpu CPU id for disassembling.
770	* @param fFlagsDisasm The flags to use for disassembling.
771	* @param pidxInstrStart The instruction index to start searching for on input,
772	* The last instruction evaluated on output.
773	* @param pAddrDest Where to store the candidate address on success.
774	*/
775	static bool dbgfR3FlowSearchMovWithConstantPtrSizeBackwards(PDBGFFLOWBBINT pFlowBb, uint8_t idxRegTgt, uint32_t cbPtr,
776	PUVM pUVM, VMCPUID idCpu, uint32_t fFlagsDisasm,
777	uint32_t *pidxInstrStart, PDBGFADDRESS pAddrDest)
778	{
779	bool fFound = false;
780	uint32_t idxInstrCur = *pidxInstrStart;
781	uint32_t cInstrCheck = idxInstrCur + 1;
782
783	for (;;)
784	{
785	/** @todo Avoid to disassemble again. */
786	PDBGFFLOWBBINSTR pInstr = &pFlowBb->aInstr[idxInstrCur];
787	DBGFDISSTATE DisState;
788	char szOutput[_4K];
789
790	int rc = dbgfR3DisasInstrStateEx(pUVM, idCpu, &pInstr->AddrInstr, fFlagsDisasm,
791	&szOutput[0], sizeof(szOutput), &DisState);
792	if (RT_SUCCESS(rc))
793	{
794	if ( DisState.pCurInstr->uOpcode == OP_MOV
795	&& (DisState.Param1.fUse & (DISUSE_REG_GEN16 \| DISUSE_REG_GEN32 \| DISUSE_REG_GEN64))
796	&& DisState.Param1.Base.idxGenReg == idxRegTgt
797	/&& DisState.Param1.cb == cbPtr/
798	&& DisState.Param2.cb == cbPtr
799	&& (DisState.Param2.fUse & (DISUSE_IMMEDIATE16 \| DISUSE_IMMEDIATE32 \| DISUSE_IMMEDIATE64)))
800	{
801	/* Found possible candidate. */
802	fFound = true;
803	if (DBGFADDRESS_IS_FLAT(&pInstr->AddrInstr))
804	DBGFR3AddrFromFlat(pUVM, pAddrDest, DisState.Param2.uValue);
805	else
806	DBGFR3AddrFromSelOff(pUVM, idCpu, pAddrDest, pInstr->AddrInstr.Sel, DisState.Param2.uValue);
807	break;
808	}
809	}
810	else
811	break;
812
813	cInstrCheck--;
814	if (!cInstrCheck)
815	break;
816
817	idxInstrCur--;
818	}
819
820	*pidxInstrStart = idxInstrCur;
821	return fFound;
822	}
823
824
825	/**
826	* Verifies the given branch table candidate and adds it to the control flow graph on success.
827	*
828	* @returns VBox status code.
829	* @param pThis The flow control graph.
830	* @param pFlowBb The basic block causing the indirect branch.
831	* @param pAddrBranchTbl Address of the branch table location.
832	* @param idxGenRegBase The general register holding the base address.
833	* @param cbPtr Guest pointer size.
834	* @param pUVM The user mode VM handle.
835	* @param idCpu CPU id for disassembling.
836	*
837	* @todo Handle branch tables greater than 4KB (lazy coder).
838	*/
839	static int dbgfR3FlowBranchTblVerifyAdd(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PDBGFADDRESS pAddrBranchTbl,
840	uint8_t idxGenRegBase, uint32_t cbPtr, PUVM pUVM, VMCPUID idCpu)
841	{
842	int rc = VINF_SUCCESS;
843	PDBGFFLOWBRANCHTBLINT pBranchTbl = dbgfR3FlowBranchTblFindByAddr(pThis, pAddrBranchTbl);
844
845	if (!pBranchTbl)
846	{
847	uint32_t cSlots = 0;
848	uint8_t abBuf[_4K];
849
850	rc = DBGFR3MemRead(pUVM, idCpu, pAddrBranchTbl, &abBuf[0], sizeof(abBuf));
851	if (RT_SUCCESS(rc))
852	{
853	uint8_t *pbBuf = &abBuf[0];
854	while (pbBuf < &abBuf[0] + sizeof(abBuf))
855	{
856	DBGFADDRESS AddrDest;
857	RTGCUINTPTR GCPtr = cbPtr == sizeof(uint64_t)
858	? (uint64_t )pbBuf
859	: cbPtr == sizeof(uint32_t)
860	? (uint32_t )pbBuf
861	: (uint16_t )pbBuf;
862	pbBuf += cbPtr;
863
864	if (DBGFADDRESS_IS_FLAT(pAddrBranchTbl))
865	DBGFR3AddrFromFlat(pUVM, &AddrDest, GCPtr);
866	else
867	DBGFR3AddrFromSelOff(pUVM, idCpu, &AddrDest, pAddrBranchTbl->Sel, GCPtr);
868
869	if (dbgfR3FlowAddrGetDistance(&AddrDest, &pFlowBb->AddrEnd) > _512K)
870	break;
871
872	cSlots++;
873	}
874
875	/* If there are any slots use it. */
876	if (cSlots)
877	{
878	pBranchTbl = dbgfR3FlowBranchTblCreate(pThis, pAddrBranchTbl, idxGenRegBase, cSlots);
879	if (pBranchTbl)
880	{
881	/* Get the addresses. */
882	for (unsigned i = 0; i < cSlots && RT_SUCCESS(rc); i++)
883	{
884	RTGCUINTPTR GCPtr = cbPtr == sizeof(uint64_t)
885	? (uint64_t )&abBuf[i * cbPtr]
886	: cbPtr == sizeof(uint32_t)
887	? (uint32_t )&abBuf[i * cbPtr]
888	: (uint16_t )&abBuf[i * cbPtr];
889
890	if (DBGFADDRESS_IS_FLAT(pAddrBranchTbl))
891	DBGFR3AddrFromFlat(pUVM, &pBranchTbl->aAddresses[i], GCPtr);
892	else
893	DBGFR3AddrFromSelOff(pUVM, idCpu, &pBranchTbl->aAddresses[i],
894	pAddrBranchTbl->Sel, GCPtr);
895	rc = dbgfR3FlowBbSuccessorAdd(pThis, &pBranchTbl->aAddresses[i], DBGF_FLOW_BB_F_BRANCH_TABLE,
896	pBranchTbl);
897	}
898	dbgfR3FlowBranchTblLink(pThis, pBranchTbl);
899	}
900	else
901	rc = VERR_NO_MEMORY;
902	}
903	}
904	}
905
906	if (pBranchTbl)
907	pFlowBb->pFlowBranchTbl = pBranchTbl;
908
909	return rc;
910	}
911
912
913	/**
914	* Checks whether the location for the branch target candidate contains a valid code address.
915	*
916	* @returns VBox status code.
917	* @param pThis The flow control graph.
918	* @param pFlowBb The basic block causing the indirect branch.
919	* @param pAddrBranchTgt Address of the branch target location.
920	* @param idxGenRegBase The general register holding the address of the location.
921	* @param cbPtr Guest pointer size.
922	* @param pUVM The user mode VM handle.
923	* @param idCpu CPU id for disassembling.
924	* @param fBranchTbl Flag whether this is a possible branch table containing multiple
925	* targets.
926	*/
927	static int dbgfR3FlowCheckBranchTargetLocation(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PDBGFADDRESS pAddrBranchTgt,
928	uint8_t idxGenRegBase, uint32_t cbPtr, PUVM pUVM, VMCPUID idCpu, bool fBranchTbl)
929	{
930	int rc = VINF_SUCCESS;
931
932	if (!fBranchTbl)
933	{
934	union { uint16_t u16Val; uint32_t u32Val; uint64_t u64Val; } uVal;
935	rc = DBGFR3MemRead(pUVM, idCpu, pAddrBranchTgt, &uVal, cbPtr);
936	if (RT_SUCCESS(rc))
937	{
938	DBGFADDRESS AddrTgt;
939	RTGCUINTPTR GCPtr = cbPtr == sizeof(uint64_t)
940	? uVal.u64Val
941	: cbPtr == sizeof(uint32_t)
942	? uVal.u32Val
943	: uVal.u16Val;
944	if (DBGFADDRESS_IS_FLAT(pAddrBranchTgt))
945	DBGFR3AddrFromFlat(pUVM, &AddrTgt, GCPtr);
946	else
947	DBGFR3AddrFromSelOff(pUVM, idCpu, &AddrTgt, pAddrBranchTgt->Sel, GCPtr);
948
949	if (dbgfR3FlowAddrGetDistance(&AddrTgt, &pFlowBb->AddrEnd) <= _128K)
950	{
951	/* Finish the basic block. */
952	pFlowBb->AddrTarget = AddrTgt;
953	rc = dbgfR3FlowBbSuccessorAdd(pThis, &AddrTgt,
954	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
955	pFlowBb->pFlowBranchTbl);
956	}
957	else
958	rc = VERR_NOT_FOUND;
959	}
960	}
961	else
962	rc = dbgfR3FlowBranchTblVerifyAdd(pThis, pFlowBb, pAddrBranchTgt,
963	idxGenRegBase, cbPtr, pUVM, idCpu);
964
965	return rc;
966	}
967
968
969	/**
970	* Tries to resolve the indirect branch.
971	*
972	* @returns VBox status code.
973	* @param pThis The flow control graph.
974	* @param pFlowBb The basic block causing the indirect branch.
975	* @param pUVM The user mode VM handle.
976	* @param idCpu CPU id for disassembling.
977	* @param pDisParam The parameter from the disassembler.
978	* @param fFlagsDisasm Flags for the disassembler.
979	*/
980	static int dbgfR3FlowTryResolveIndirectBranch(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PUVM pUVM,
981	VMCPUID idCpu, PDISOPPARAM pDisParam, uint32_t fFlagsDisasm)
982	{
983	Assert(dbgfR3FlowBranchTargetIsIndirect(pDisParam));
984
985	uint32_t cbPtr = 0;
986	CPUMMODE enmMode = dbgfR3FlowGetDisasCpuMode(pUVM, idCpu, fFlagsDisasm);
987
988	switch (enmMode)
989	{
990	case CPUMMODE_REAL:
991	cbPtr = sizeof(uint16_t);
992	break;
993	case CPUMMODE_PROTECTED:
994	cbPtr = sizeof(uint32_t);
995	break;
996	case CPUMMODE_LONG:
997	cbPtr = sizeof(uint64_t);
998	break;
999	default:
1000	AssertMsgFailed(("Invalid CPU mode %u\n", enmMode));
1001	}
1002
1003	if (pDisParam->fUse & DISUSE_BASE)
1004	{
1005	uint8_t idxRegBase = pDisParam->Base.idxGenReg;
1006
1007	/* Check that the used register size and the pointer size match. */
1008	if ( ((pDisParam->fUse & DISUSE_REG_GEN16) && cbPtr == sizeof(uint16_t))
1009	\|\| ((pDisParam->fUse & DISUSE_REG_GEN32) && cbPtr == sizeof(uint32_t))
1010	\|\| ((pDisParam->fUse & DISUSE_REG_GEN64) && cbPtr == sizeof(uint64_t)))
1011	{
1012	/*
1013	* Search all instructions backwards until a move to the used general register
1014	* is detected with a constant using the pointer size.
1015	*/
1016	uint32_t idxInstrStart = pFlowBb->cInstr - 1 - 1; /* Don't look at the branch. */
1017	bool fCandidateFound = false;
1018	bool fBranchTbl = RT_BOOL(pDisParam->fUse & DISUSE_INDEX);
1019	DBGFADDRESS AddrBranchTgt;
1020	do
1021	{
1022	fCandidateFound = dbgfR3FlowSearchMovWithConstantPtrSizeBackwards(pFlowBb, idxRegBase, cbPtr,
1023	pUVM, idCpu, fFlagsDisasm,
1024	&idxInstrStart, &AddrBranchTgt);
1025	if (fCandidateFound)
1026	{
1027	/* Check that the address is not too far away from the instruction address. */
1028	RTGCUINTPTR offPtr = dbgfR3FlowAddrGetDistance(&AddrBranchTgt, &pFlowBb->AddrEnd);
1029	if (offPtr <= 20 * _1M)
1030	{
1031	/* Read the content at the address and check that it is near this basic block too. */
1032	int rc = dbgfR3FlowCheckBranchTargetLocation(pThis, pFlowBb, &AddrBranchTgt, idxRegBase,
1033	cbPtr, pUVM, idCpu, fBranchTbl);
1034	if (RT_SUCCESS(rc))
1035	break;
1036	fCandidateFound = false;
1037	}
1038
1039	if (idxInstrStart > 0)
1040	idxInstrStart--;
1041	}
1042	} while (idxInstrStart > 0 && !fCandidateFound);
1043	}
1044	else
1045	dbgfR3FlowBbSetError(pFlowBb, VERR_INVALID_STATE,
1046	"The base register size and selected pointer size do not match (fUse=%#x cbPtr=%u)",
1047	pDisParam->fUse, cbPtr);
1048	}
1049
1050	return VINF_SUCCESS;
1051	}
1052
1053
1054	/**
1055	* Tries to resolve the indirect branch.
1056	*
1057	* @returns VBox status code.
1058	* @param pThis The flow control graph.
1059	* @param pFlowBb The basic block causing the indirect branch.
1060	* @param pUVM The user mode VM handle.
1061	* @param idCpu CPU id for disassembling.
1062	* @param pDisParam The parameter from the disassembler.
1063	* @param fFlagsDisasm Flags for the disassembler.
1064	*/
1065	static int dbgfR3FlowBbCheckBranchTblCandidate(PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb, PUVM pUVM,
1066	VMCPUID idCpu, PDISOPPARAM pDisParam, uint32_t fFlagsDisasm)
1067	{
1068	int rc = VINF_SUCCESS;
1069
1070	Assert(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE && pFlowBb->pFlowBranchTbl);
1071
1072	uint32_t cbPtr = 0;
1073	CPUMMODE enmMode = dbgfR3FlowGetDisasCpuMode(pUVM, idCpu, fFlagsDisasm);
1074
1075	switch (enmMode)
1076	{
1077	case CPUMMODE_REAL:
1078	cbPtr = sizeof(uint16_t);
1079	break;
1080	case CPUMMODE_PROTECTED:
1081	cbPtr = sizeof(uint32_t);
1082	break;
1083	case CPUMMODE_LONG:
1084	cbPtr = sizeof(uint64_t);
1085	break;
1086	default:
1087	AssertMsgFailed(("Invalid CPU mode %u\n", enmMode));
1088	}
1089
1090	if (pDisParam->fUse & DISUSE_BASE)
1091	{
1092	uint8_t idxRegBase = pDisParam->Base.idxGenReg;
1093
1094	/* Check that the used register size and the pointer size match. */
1095	if ( ((pDisParam->fUse & DISUSE_REG_GEN16) && cbPtr == sizeof(uint16_t))
1096	\|\| ((pDisParam->fUse & DISUSE_REG_GEN32) && cbPtr == sizeof(uint32_t))
1097	\|\| ((pDisParam->fUse & DISUSE_REG_GEN64) && cbPtr == sizeof(uint64_t)))
1098	{
1099	if (idxRegBase != pFlowBb->pFlowBranchTbl->idxGenRegBase)
1100	{
1101	/* Try to find the new branch table. */
1102	pFlowBb->pFlowBranchTbl = NULL;
1103	rc = dbgfR3FlowTryResolveIndirectBranch(pThis, pFlowBb, pUVM, idCpu, pDisParam, fFlagsDisasm);
1104	}
1105	/** @todo else check that the base register is not modified in this basic block. */
1106	}
1107	else
1108	dbgfR3FlowBbSetError(pFlowBb, VERR_INVALID_STATE,
1109	"The base register size and selected pointer size do not match (fUse=%#x cbPtr=%u)",
1110	pDisParam->fUse, cbPtr);
1111	}
1112	else
1113	dbgfR3FlowBbSetError(pFlowBb, VERR_INVALID_STATE,
1114	"The instruction does not use a register");
1115
1116	return rc;
1117	}
1118
1119
1120	/**
1121	* Processes and fills one basic block.
1122	*
1123	* @returns VBox status code.
1124	* @param pUVM The user mode VM handle.
1125	* @param idCpu CPU id for disassembling.
1126	* @param pThis The control flow graph to populate.
1127	* @param pFlowBb The basic block to fill.
1128	* @param cbDisasmMax The maximum amount to disassemble.
1129	* @param fFlags Combination of DBGF_DISAS_FLAGS_*.
1130	*/
1131	static int dbgfR3FlowBbProcess(PUVM pUVM, VMCPUID idCpu, PDBGFFLOWINT pThis, PDBGFFLOWBBINT pFlowBb,
1132	uint32_t cbDisasmMax, uint32_t fFlags)
1133	{
1134	int rc = VINF_SUCCESS;
1135	uint32_t cbDisasmLeft = cbDisasmMax ? cbDisasmMax : UINT32_MAX;
1136	DBGFADDRESS AddrDisasm = pFlowBb->AddrEnd;
1137
1138	Assert(pFlowBb->fFlags & DBGF_FLOW_BB_F_EMPTY);
1139
1140	/*
1141	* Disassemble instruction by instruction until we get a conditional or
1142	* unconditional jump or some sort of return.
1143	*/
1144	while ( cbDisasmLeft
1145	&& RT_SUCCESS(rc))
1146	{
1147	DBGFDISSTATE DisState;
1148	char szOutput[_4K];
1149
1150	/*
1151	* Before disassembling we have to check whether the address belongs
1152	* to another basic block and stop here.
1153	*/
1154	if ( !(pFlowBb->fFlags & DBGF_FLOW_BB_F_EMPTY)
1155	&& dbgfR3FlowHasBbWithStartAddr(pThis, &AddrDisasm))
1156	{
1157	pFlowBb->AddrTarget = AddrDisasm;
1158	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND;
1159	break;
1160	}
1161
1162	rc = dbgfR3DisasInstrStateEx(pUVM, idCpu, &AddrDisasm, fFlags,
1163	&szOutput[0], sizeof(szOutput), &DisState);
1164	if (RT_SUCCESS(rc))
1165	{
1166	if ( pThis->fFlags & DBGF_FLOW_CREATE_F_CALL_INSN_SEPARATE_BB
1167	&& DisState.pCurInstr->uOpcode == OP_CALL
1168	&& !(pFlowBb->fFlags & DBGF_FLOW_BB_F_EMPTY))
1169	{
1170	/*
1171	* If the basic block is not empty, the basic block is terminated and the successor is added
1172	* which will contain the call instruction.
1173	*/
1174	pFlowBb->AddrTarget = AddrDisasm;
1175	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND;
1176	rc = dbgfR3FlowBbSuccessorAdd(pThis, &AddrDisasm,
1177	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
1178	pFlowBb->pFlowBranchTbl);
1179	if (RT_FAILURE(rc))
1180	dbgfR3FlowBbSetError(pFlowBb, rc, "Adding successor blocks failed with %Rrc", rc);
1181	break;
1182	}
1183
1184	pFlowBb->fFlags &= ~DBGF_FLOW_BB_F_EMPTY;
1185	cbDisasmLeft -= DisState.cbInstr;
1186
1187	if (pFlowBb->cInstr == pFlowBb->cInstrMax)
1188	{
1189	/* Reallocate. */
1190	RTListNodeRemove(&pFlowBb->NdFlowBb);
1191	PDBGFFLOWBBINT pFlowBbNew = (PDBGFFLOWBBINT)RTMemRealloc(pFlowBb,
1192	RT_UOFFSETOF_DYN(DBGFFLOWBBINT, aInstr[pFlowBb->cInstrMax + 10]));
1193	if (pFlowBbNew)
1194	{
1195	pFlowBbNew->cInstrMax += 10;
1196	pFlowBb = pFlowBbNew;
1197	}
1198	else
1199	rc = VERR_NO_MEMORY;
1200	RTListAppend(&pThis->LstFlowBb, &pFlowBb->NdFlowBb);
1201	}
1202
1203	if (RT_SUCCESS(rc))
1204	{
1205	PDBGFFLOWBBINSTR pInstr = &pFlowBb->aInstr[pFlowBb->cInstr];
1206
1207	pInstr->AddrInstr = AddrDisasm;
1208	pInstr->cbInstr = DisState.cbInstr;
1209	pInstr->pszInstr = RTStrCacheEnter(pThis->hStrCacheInstr, &szOutput[0]);
1210	pFlowBb->cInstr++;
1211
1212	pFlowBb->AddrEnd = AddrDisasm;
1213	DBGFR3AddrAdd(&pFlowBb->AddrEnd, pInstr->cbInstr - 1);
1214	DBGFR3AddrAdd(&AddrDisasm, pInstr->cbInstr);
1215
1216	/*
1217	* Check control flow instructions and create new basic blocks
1218	* marking the current one as complete.
1219	*/
1220	if (DisState.pCurInstr->fOpType & DISOPTYPE_CONTROLFLOW)
1221	{
1222	uint16_t uOpc = DisState.pCurInstr->uOpcode;
1223
1224	if (uOpc == OP_CALL)
1225	pThis->cCallInsns++;
1226
1227	if ( uOpc == OP_RETN \|\| uOpc == OP_RETF \|\| uOpc == OP_IRET
1228	\|\| uOpc == OP_SYSEXIT \|\| uOpc == OP_SYSRET)
1229	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_EXIT;
1230	else if (uOpc == OP_JMP)
1231	{
1232	Assert(DisState.pCurInstr->fOpType & DISOPTYPE_UNCOND_CONTROLFLOW);
1233
1234	if (dbgfR3FlowBranchTargetIsIndirect(&DisState.Param1))
1235	{
1236	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND_INDIRECT_JMP;
1237
1238	if (pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE)
1239	{
1240	Assert(pThis->fFlags & DBGF_FLOW_CREATE_F_TRY_RESOLVE_INDIRECT_BRANCHES);
1241
1242	/*
1243	* This basic block was already discovered by parsing a jump table and
1244	* there should be a candidate for the branch table. Check whether it uses the
1245	* same branch table.
1246	*/
1247	rc = dbgfR3FlowBbCheckBranchTblCandidate(pThis, pFlowBb, pUVM, idCpu,
1248	&DisState.Param1, fFlags);
1249	}
1250	else
1251	{
1252	if (pThis->fFlags & DBGF_FLOW_CREATE_F_TRY_RESOLVE_INDIRECT_BRANCHES)
1253	rc = dbgfR3FlowTryResolveIndirectBranch(pThis, pFlowBb, pUVM, idCpu,
1254	&DisState.Param1, fFlags);
1255	else
1256	dbgfR3FlowBbSetError(pFlowBb, VERR_NOT_SUPPORTED,
1257	"Detected indirect branch and resolving it not being enabled");
1258	}
1259	}
1260	else
1261	{
1262	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND_JMP;
1263
1264	/* Create one new basic block with the jump target address. */
1265	rc = dbgfR3FlowQueryDirectBranchTarget(pUVM, idCpu, &DisState.Param1, &pInstr->AddrInstr, pInstr->cbInstr,
1266	RT_BOOL(DisState.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW),
1267	&pFlowBb->AddrTarget);
1268	if (RT_SUCCESS(rc))
1269	rc = dbgfR3FlowBbSuccessorAdd(pThis, &pFlowBb->AddrTarget,
1270	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
1271	pFlowBb->pFlowBranchTbl);
1272	}
1273	}
1274	else if (uOpc != OP_CALL)
1275	{
1276	Assert(DisState.pCurInstr->fOpType & DISOPTYPE_COND_CONTROLFLOW);
1277	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_COND;
1278
1279	/*
1280	* Create two new basic blocks, one with the jump target address
1281	* and one starting after the current instruction.
1282	*/
1283	rc = dbgfR3FlowBbSuccessorAdd(pThis, &AddrDisasm,
1284	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
1285	pFlowBb->pFlowBranchTbl);
1286	if (RT_SUCCESS(rc))
1287	{
1288	rc = dbgfR3FlowQueryDirectBranchTarget(pUVM, idCpu, &DisState.Param1, &pInstr->AddrInstr, pInstr->cbInstr,
1289	RT_BOOL(DisState.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW),
1290	&pFlowBb->AddrTarget);
1291	if (RT_SUCCESS(rc))
1292	rc = dbgfR3FlowBbSuccessorAdd(pThis, &pFlowBb->AddrTarget,
1293	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
1294	pFlowBb->pFlowBranchTbl);
1295	}
1296	}
1297	else if (pThis->fFlags & DBGF_FLOW_CREATE_F_CALL_INSN_SEPARATE_BB)
1298	{
1299	pFlowBb->enmEndType = DBGFFLOWBBENDTYPE_UNCOND;
1300	pFlowBb->fFlags \|= DBGF_FLOW_BB_F_CALL_INSN;
1301
1302	/* Add new basic block coming after the call instruction. */
1303	rc = dbgfR3FlowBbSuccessorAdd(pThis, &AddrDisasm,
1304	(pFlowBb->fFlags & DBGF_FLOW_BB_F_BRANCH_TABLE),
1305	pFlowBb->pFlowBranchTbl);
1306	if ( RT_SUCCESS(rc)
1307	&& !dbgfR3FlowBranchTargetIsIndirect(&DisState.Param1))
1308	{
1309	/* Resolve the branch target. */
1310	rc = dbgfR3FlowQueryDirectBranchTarget(pUVM, idCpu, &DisState.Param1, &pInstr->AddrInstr, pInstr->cbInstr,
1311	RT_BOOL(DisState.pCurInstr->fOpType & DISOPTYPE_RELATIVE_CONTROLFLOW),
1312	&pFlowBb->AddrTarget);
1313	if (RT_SUCCESS(rc))
1314	pFlowBb->fFlags \|= DBGF_FLOW_BB_F_CALL_INSN_TARGET_KNOWN;
1315	}
1316	}
1317
1318	if (RT_FAILURE(rc))
1319	dbgfR3FlowBbSetError(pFlowBb, rc, "Adding successor blocks failed with %Rrc", rc);
1320
1321	/* Quit disassembling. */
1322	if ( ( uOpc != OP_CALL
1323	\|\| (pThis->fFlags & DBGF_FLOW_CREATE_F_CALL_INSN_SEPARATE_BB))
1324	\|\| RT_FAILURE(rc))
1325	break;
1326	}
1327	}
1328	else
1329	dbgfR3FlowBbSetError(pFlowBb, rc, "Increasing basic block failed with %Rrc", rc);
1330	}
1331	else
1332	dbgfR3FlowBbSetError(pFlowBb, rc, "Disassembling the instruction failed with %Rrc", rc);
1333	}
1334
1335	return VINF_SUCCESS;
1336	}
1337
1338	/**
1339	* Populate all empty basic blocks.
1340	*
1341	* @returns VBox status code.
1342	* @param pUVM The user mode VM handle.
1343	* @param idCpu CPU id for disassembling.
1344	* @param pThis The control flow graph to populate.
1345	* @param cbDisasmMax The maximum amount to disassemble.
1346	* @param fFlags Combination of DBGF_DISAS_FLAGS_*.
1347	*/
1348	static int dbgfR3FlowPopulate(PUVM pUVM, VMCPUID idCpu, PDBGFFLOWINT pThis, uint32_t cbDisasmMax, uint32_t fFlags)
1349	{
1350	int rc = VINF_SUCCESS;
1351	PDBGFFLOWBBINT pFlowBb = dbgfR3FlowGetUnpopulatedBb(pThis);
1352
1353	while (pFlowBb != NULL)
1354	{
1355	rc = dbgfR3FlowBbProcess(pUVM, idCpu, pThis, pFlowBb, cbDisasmMax, fFlags);
1356	if (RT_FAILURE(rc))
1357	break;
1358
1359	pFlowBb = dbgfR3FlowGetUnpopulatedBb(pThis);
1360	}
1361
1362	return rc;
1363	}
1364
1365	/**
1366	* Creates a new control flow graph from the given start address.
1367	*
1368	* @returns VBox status code.
1369	* @param pUVM The user mode VM handle.
1370	* @param idCpu CPU id for disassembling.
1371	* @param pAddressStart Where to start creating the control flow graph.
1372	* @param cbDisasmMax Limit the amount of bytes to disassemble, 0 for no limit.
1373	* @param fFlagsFlow Combination of DBGF_FLOW_CREATE_F_* to control the creation of the flow graph.
1374	* @param fFlagsDisasm Combination of DBGF_DISAS_FLAGS_* controlling the style of the disassembled
1375	* instructions.
1376	* @param phFlow Where to store the handle to the control flow graph on success.
1377	*/
1378	VMMR3DECL(int) DBGFR3FlowCreate(PUVM pUVM, VMCPUID idCpu, PDBGFADDRESS pAddressStart, uint32_t cbDisasmMax,
1379	uint32_t fFlagsFlow, uint32_t fFlagsDisasm, PDBGFFLOW phFlow)
1380	{
1381	UVM_ASSERT_VALID_EXT_RETURN(pUVM, VERR_INVALID_VM_HANDLE);
1382	PVM pVM = pUVM->pVM;
1383	VM_ASSERT_VALID_EXT_RETURN(pVM, VERR_INVALID_VM_HANDLE);
1384	AssertReturn(idCpu < pUVM->cCpus, VERR_INVALID_CPU_ID);
1385	AssertPtrReturn(pAddressStart, VERR_INVALID_POINTER);
1386	AssertReturn(!(fFlagsDisasm & ~DBGF_DISAS_FLAGS_VALID_MASK), VERR_INVALID_PARAMETER);
1387	AssertReturn((fFlagsDisasm & DBGF_DISAS_FLAGS_MODE_MASK) <= DBGF_DISAS_FLAGS_64BIT_MODE, VERR_INVALID_PARAMETER);
1388
1389	/* Create the control flow graph container. */
1390	int rc = VINF_SUCCESS;
1391	PDBGFFLOWINT pThis = (PDBGFFLOWINT)RTMemAllocZ(sizeof(DBGFFLOWINT));
1392	if (RT_LIKELY(pThis))
1393	{
1394	rc = RTStrCacheCreate(&pThis->hStrCacheInstr, "DBGFFLOW");
1395	if (RT_SUCCESS(rc))
1396	{
1397	pThis->cRefs = 1;
1398	pThis->cRefsBb = 0;
1399	pThis->cBbs = 0;
1400	pThis->cBranchTbls = 0;
1401	pThis->cCallInsns = 0;
1402	pThis->fFlags = fFlagsFlow;
1403	RTListInit(&pThis->LstFlowBb);
1404	RTListInit(&pThis->LstBranchTbl);
1405	/* Create the entry basic block and start the work. */
1406
1407	PDBGFFLOWBBINT pFlowBb = dbgfR3FlowBbCreate(pThis, pAddressStart, DBGF_FLOW_BB_F_ENTRY, 10);
1408	if (RT_LIKELY(pFlowBb))
1409	{
1410	dbgfR3FlowLink(pThis, pFlowBb);
1411	rc = dbgfR3FlowPopulate(pUVM, idCpu, pThis, cbDisasmMax, fFlagsDisasm);
1412	if (RT_SUCCESS(rc))
1413	{
1414	*phFlow = pThis;
1415	return VINF_SUCCESS;
1416	}
1417	}
1418	else
1419	rc = VERR_NO_MEMORY;
1420	}
1421
1422	ASMAtomicDecU32(&pThis->cRefs);
1423	dbgfR3FlowDestroy(pThis);
1424	}
1425	else
1426	rc = VERR_NO_MEMORY;
1427
1428	return rc;
1429	}
1430
1431
1432	/**
1433	* Retains the control flow graph handle.
1434	*
1435	* @returns Current reference count.
1436	* @param hFlow The control flow graph handle to retain.
1437	*/
1438	VMMR3DECL(uint32_t) DBGFR3FlowRetain(DBGFFLOW hFlow)
1439	{
1440	PDBGFFLOWINT pThis = hFlow;
1441	AssertPtrReturn(pThis, UINT32_MAX);
1442
1443	uint32_t cRefs = ASMAtomicIncU32(&pThis->cRefs);
1444	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pThis));
1445	return cRefs;
1446	}
1447
1448
1449	/**
1450	* Releases the control flow graph handle.
1451	*
1452	* @returns Current reference count, on 0 the control flow graph will be destroyed.
1453	* @param hFlow The control flow graph handle to release.
1454	*/
1455	VMMR3DECL(uint32_t) DBGFR3FlowRelease(DBGFFLOW hFlow)
1456	{
1457	PDBGFFLOWINT pThis = hFlow;
1458	if (!pThis)
1459	return 0;
1460	AssertPtrReturn(pThis, UINT32_MAX);
1461
1462	uint32_t cRefs = ASMAtomicDecU32(&pThis->cRefs);
1463	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pThis));
1464	if (cRefs == 0)
1465	dbgfR3FlowDestroy(pThis);
1466	return cRefs;
1467	}
1468
1469
1470	/**
1471	* Queries the basic block denoting the entry point into the control flow graph.
1472	*
1473	* @returns VBox status code.
1474	* @param hFlow The control flow graph handle.
1475	* @param phFlowBb Where to store the basic block handle on success.
1476	*/
1477	VMMR3DECL(int) DBGFR3FlowQueryStartBb(DBGFFLOW hFlow, PDBGFFLOWBB phFlowBb)
1478	{
1479	PDBGFFLOWINT pThis = hFlow;
1480	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
1481
1482	PDBGFFLOWBBINT pFlowBb;
1483	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
1484	{
1485	if (pFlowBb->fFlags & DBGF_FLOW_BB_F_ENTRY)
1486	{
1487	*phFlowBb = pFlowBb;
1488	return VINF_SUCCESS;
1489	}
1490	}
1491
1492	AssertFailed(); /* Should never get here. */
1493	return VERR_INTERNAL_ERROR;
1494	}
1495
1496
1497	/**
1498	* Queries a basic block in the given control flow graph which covers the given
1499	* address.
1500	*
1501	* @returns VBox status code.
1502	* @retval VERR_NOT_FOUND if there is no basic block intersecting with the address.
1503	* @param hFlow The control flow graph handle.
1504	* @param pAddr The address to look for.
1505	* @param phFlowBb Where to store the basic block handle on success.
1506	*/
1507	VMMR3DECL(int) DBGFR3FlowQueryBbByAddress(DBGFFLOW hFlow, PDBGFADDRESS pAddr, PDBGFFLOWBB phFlowBb)
1508	{
1509	PDBGFFLOWINT pThis = hFlow;
1510	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
1511	AssertPtrReturn(pAddr, VERR_INVALID_POINTER);
1512	AssertPtrReturn(phFlowBb, VERR_INVALID_POINTER);
1513
1514	PDBGFFLOWBBINT pFlowBb;
1515	RTListForEach(&pThis->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
1516	{
1517	if (dbgfR3FlowAddrIntersect(pFlowBb, pAddr))
1518	{
1519	DBGFR3FlowBbRetain(pFlowBb);
1520	*phFlowBb = pFlowBb;
1521	return VINF_SUCCESS;
1522	}
1523	}
1524
1525	return VERR_NOT_FOUND;
1526	}
1527
1528
1529	/**
1530	* Queries a branch table in the given control flow graph by the given address.
1531	*
1532	* @returns VBox status code.
1533	* @retval VERR_NOT_FOUND if there is no branch table with the given address.
1534	* @param hFlow The control flow graph handle.
1535	* @param pAddr The address of the branch table.
1536	* @param phFlowBranchTbl Where to store the handle to branch table on success.
1537	*
1538	* @note Call DBGFR3FlowBranchTblRelease() when the handle is not required anymore.
1539	*/
1540	VMMR3DECL(int) DBGFR3FlowQueryBranchTblByAddress(DBGFFLOW hFlow, PDBGFADDRESS pAddr, PDBGFFLOWBRANCHTBL phFlowBranchTbl)
1541	{
1542	PDBGFFLOWINT pThis = hFlow;
1543	AssertPtrReturn(pThis, VERR_INVALID_HANDLE);
1544	AssertPtrReturn(pAddr, VERR_INVALID_POINTER);
1545	AssertPtrReturn(phFlowBranchTbl, VERR_INVALID_POINTER);
1546
1547	PDBGFFLOWBRANCHTBLINT pBranchTbl = dbgfR3FlowBranchTblFindByAddr(pThis, pAddr);
1548	if (pBranchTbl)
1549	{
1550	DBGFR3FlowBranchTblRetain(pBranchTbl);
1551	*phFlowBranchTbl = pBranchTbl;
1552	return VINF_SUCCESS;
1553	}
1554
1555	return VERR_NOT_FOUND;
1556	}
1557
1558
1559	/**
1560	* Returns the number of basic blcoks inside the control flow graph.
1561	*
1562	* @returns Number of basic blocks.
1563	* @param hFlow The control flow graph handle.
1564	*/
1565	VMMR3DECL(uint32_t) DBGFR3FlowGetBbCount(DBGFFLOW hFlow)
1566	{
1567	PDBGFFLOWINT pThis = hFlow;
1568	AssertPtrReturn(pThis, 0);
1569
1570	return pThis->cBbs;
1571	}
1572
1573
1574	/**
1575	* Returns the number of branch tables inside the control flow graph.
1576	*
1577	* @returns Number of basic blocks.
1578	* @param hFlow The control flow graph handle.
1579	*/
1580	VMMR3DECL(uint32_t) DBGFR3FlowGetBranchTblCount(DBGFFLOW hFlow)
1581	{
1582	PDBGFFLOWINT pThis = hFlow;
1583	AssertPtrReturn(pThis, 0);
1584
1585	return pThis->cBranchTbls;
1586	}
1587
1588
1589	/**
1590	* Returns the number of call instructions encountered in the given
1591	* control flow graph.
1592	*
1593	* @returns Number of call instructions.
1594	* @param hFlow The control flow graph handle.
1595	*/
1596	VMMR3DECL(uint32_t) DBGFR3FlowGetCallInsnCount(DBGFFLOW hFlow)
1597	{
1598	PDBGFFLOWINT pThis = hFlow;
1599	AssertPtrReturn(pThis, 0);
1600
1601	return pThis->cCallInsns;
1602	}
1603
1604
1605	/**
1606	* Retains the basic block handle.
1607	*
1608	* @returns Current reference count.
1609	* @param hFlowBb The basic block handle to retain.
1610	*/
1611	VMMR3DECL(uint32_t) DBGFR3FlowBbRetain(DBGFFLOWBB hFlowBb)
1612	{
1613	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1614	AssertPtrReturn(pFlowBb, UINT32_MAX);
1615
1616	uint32_t cRefs = ASMAtomicIncU32(&pFlowBb->cRefs);
1617	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p %d\n", cRefs, pFlowBb, pFlowBb->enmEndType));
1618	return cRefs;
1619	}
1620
1621
1622	/**
1623	* Releases the basic block handle.
1624	*
1625	* @returns Current reference count, on 0 the basic block will be destroyed.
1626	* @param hFlowBb The basic block handle to release.
1627	*/
1628	VMMR3DECL(uint32_t) DBGFR3FlowBbRelease(DBGFFLOWBB hFlowBb)
1629	{
1630	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1631	if (!pFlowBb)
1632	return 0;
1633
1634	return dbgfR3FlowBbReleaseInt(pFlowBb, true /* fMayDestroyFlow */);
1635	}
1636
1637
1638	/**
1639	* Returns the start address of the basic block.
1640	*
1641	* @returns Pointer to DBGF adress containing the start address of the basic block.
1642	* @param hFlowBb The basic block handle.
1643	* @param pAddrStart Where to store the start address of the basic block.
1644	*/
1645	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBbGetStartAddress(DBGFFLOWBB hFlowBb, PDBGFADDRESS pAddrStart)
1646	{
1647	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1648	AssertPtrReturn(pFlowBb, NULL);
1649	AssertPtrReturn(pAddrStart, NULL);
1650
1651	*pAddrStart = pFlowBb->AddrStart;
1652	return pAddrStart;
1653	}
1654
1655
1656	/**
1657	* Returns the end address of the basic block (inclusive).
1658	*
1659	* @returns Pointer to DBGF adress containing the end address of the basic block.
1660	* @param hFlowBb The basic block handle.
1661	* @param pAddrEnd Where to store the end address of the basic block.
1662	*/
1663	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBbGetEndAddress(DBGFFLOWBB hFlowBb, PDBGFADDRESS pAddrEnd)
1664	{
1665	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1666	AssertPtrReturn(pFlowBb, NULL);
1667	AssertPtrReturn(pAddrEnd, NULL);
1668
1669	*pAddrEnd = pFlowBb->AddrEnd;
1670	return pAddrEnd;
1671	}
1672
1673
1674	/**
1675	* Returns the address the last instruction in the basic block branches to.
1676	*
1677	* @returns Pointer to DBGF adress containing the branch address of the basic block.
1678	* @param hFlowBb The basic block handle.
1679	* @param pAddrTarget Where to store the branch address of the basic block.
1680	*
1681	* @note This is only valid for unconditional or conditional branches, or for a basic block
1682	* containing only a call instruction when DBGF_FLOW_CREATE_F_CALL_INSN_SEPARATE_BB was given
1683	* during creation and the branch target could be deduced as indicated by the DBGF_FLOW_BB_F_CALL_INSN_TARGET_KNOWN
1684	* flag for the basic block. This method will assert for every other basic block type.
1685	* @note For indirect unconditional branches using a branch table this will return the start address
1686	* of the branch table.
1687	*/
1688	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBbGetBranchAddress(DBGFFLOWBB hFlowBb, PDBGFADDRESS pAddrTarget)
1689	{
1690	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1691	AssertPtrReturn(pFlowBb, NULL);
1692	AssertPtrReturn(pAddrTarget, NULL);
1693	AssertReturn( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_JMP
1694	\|\| pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_COND
1695	\|\| pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_INDIRECT_JMP
1696	\|\| ( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND
1697	&& (pFlowBb->fFlags & DBGF_FLOW_BB_F_CALL_INSN_TARGET_KNOWN)),
1698	NULL);
1699
1700	if ( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_INDIRECT_JMP
1701	&& pFlowBb->pFlowBranchTbl)
1702	*pAddrTarget = pFlowBb->pFlowBranchTbl->AddrStart;
1703	else
1704	*pAddrTarget = pFlowBb->AddrTarget;
1705	return pAddrTarget;
1706	}
1707
1708
1709	/**
1710	* Returns the address of the next block following this one in the instruction stream.
1711	* (usually end address + 1).
1712	*
1713	* @returns Pointer to DBGF adress containing the following address of the basic block.
1714	* @param hFlowBb The basic block handle.
1715	* @param pAddrFollow Where to store the following address of the basic block.
1716	*
1717	* @note This is only valid for conditional branches and if the last instruction in the
1718	* given basic block doesn't change the control flow but the blocks were split
1719	* because the successor is referenced by multiple other blocks as an entry point.
1720	*/
1721	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBbGetFollowingAddress(DBGFFLOWBB hFlowBb, PDBGFADDRESS pAddrFollow)
1722	{
1723	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1724	AssertPtrReturn(pFlowBb, NULL);
1725	AssertPtrReturn(pAddrFollow, NULL);
1726	AssertReturn( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND
1727	\|\| pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_COND,
1728	NULL);
1729
1730	*pAddrFollow = pFlowBb->AddrEnd;
1731	DBGFR3AddrAdd(pAddrFollow, 1);
1732	return pAddrFollow;
1733	}
1734
1735
1736	/**
1737	* Returns the type of the last instruction in the basic block.
1738	*
1739	* @returns Last instruction type.
1740	* @param hFlowBb The basic block handle.
1741	*/
1742	VMMR3DECL(DBGFFLOWBBENDTYPE) DBGFR3FlowBbGetType(DBGFFLOWBB hFlowBb)
1743	{
1744	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1745	AssertPtrReturn(pFlowBb, DBGFFLOWBBENDTYPE_INVALID);
1746
1747	return pFlowBb->enmEndType;
1748	}
1749
1750
1751	/**
1752	* Get the number of instructions contained in the basic block.
1753	*
1754	* @returns Number of instructions in the basic block.
1755	* @param hFlowBb The basic block handle.
1756	*/
1757	VMMR3DECL(uint32_t) DBGFR3FlowBbGetInstrCount(DBGFFLOWBB hFlowBb)
1758	{
1759	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1760	AssertPtrReturn(pFlowBb, 0);
1761
1762	return pFlowBb->cInstr;
1763	}
1764
1765
1766	/**
1767	* Get flags for the given basic block.
1768	*
1769	* @returns Combination of DBGF_FLOW_BB_F_*
1770	* @param hFlowBb The basic block handle.
1771	*/
1772	VMMR3DECL(uint32_t) DBGFR3FlowBbGetFlags(DBGFFLOWBB hFlowBb)
1773	{
1774	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1775	AssertPtrReturn(pFlowBb, 0);
1776
1777	return pFlowBb->fFlags;
1778	}
1779
1780
1781	/**
1782	* Queries the branch table used if the given basic block ends with an indirect branch
1783	* and has a branch table referenced.
1784	*
1785	* @returns VBox status code.
1786	* @param hFlowBb The basic block handle.
1787	* @param phBranchTbl Where to store the branch table handle on success.
1788	*
1789	* @note Release the branch table reference with DBGFR3FlowBranchTblRelease() when not required
1790	* anymore.
1791	*/
1792	VMMR3DECL(int) DBGFR3FlowBbQueryBranchTbl(DBGFFLOWBB hFlowBb, PDBGFFLOWBRANCHTBL phBranchTbl)
1793	{
1794	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1795	AssertPtrReturn(pFlowBb, VERR_INVALID_HANDLE);
1796	AssertReturn(pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_INDIRECT_JMP, VERR_INVALID_STATE);
1797	AssertPtrReturn(pFlowBb->pFlowBranchTbl, VERR_INVALID_STATE);
1798	AssertPtrReturn(phBranchTbl, VERR_INVALID_POINTER);
1799
1800	DBGFR3FlowBranchTblRetain(pFlowBb->pFlowBranchTbl);
1801	*phBranchTbl = pFlowBb->pFlowBranchTbl;
1802	return VINF_SUCCESS;
1803	}
1804
1805
1806	/**
1807	* Returns the error status and message if the given basic block has an error.
1808	*
1809	* @returns VBox status code of the error for the basic block.
1810	* @param hFlowBb The basic block handle.
1811	* @param ppszErr Where to store the pointer to the error message - optional.
1812	*/
1813	VMMR3DECL(int) DBGFR3FlowBbQueryError(DBGFFLOWBB hFlowBb, const char **ppszErr)
1814	{
1815	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1816	AssertPtrReturn(pFlowBb, VERR_INVALID_HANDLE);
1817
1818	if (ppszErr)
1819	*ppszErr = pFlowBb->pszErr;
1820
1821	return pFlowBb->rcError;
1822	}
1823
1824
1825	/**
1826	* Store the disassembled instruction as a string in the given output buffer.
1827	*
1828	* @returns VBox status code.
1829	* @param hFlowBb The basic block handle.
1830	* @param idxInstr The instruction to query.
1831	* @param pAddrInstr Where to store the guest instruction address on success, optional.
1832	* @param pcbInstr Where to store the instruction size on success, optional.
1833	* @param ppszInstr Where to store the pointer to the disassembled instruction string, optional.
1834	*/
1835	VMMR3DECL(int) DBGFR3FlowBbQueryInstr(DBGFFLOWBB hFlowBb, uint32_t idxInstr, PDBGFADDRESS pAddrInstr,
1836	uint32_t pcbInstr, const char *ppszInstr)
1837	{
1838	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1839	AssertPtrReturn(pFlowBb, VERR_INVALID_POINTER);
1840	AssertReturn(idxInstr < pFlowBb->cInstr, VERR_INVALID_PARAMETER);
1841
1842	if (pAddrInstr)
1843	*pAddrInstr = pFlowBb->aInstr[idxInstr].AddrInstr;
1844	if (pcbInstr)
1845	*pcbInstr = pFlowBb->aInstr[idxInstr].cbInstr;
1846	if (ppszInstr)
1847	*ppszInstr = pFlowBb->aInstr[idxInstr].pszInstr;
1848
1849	return VINF_SUCCESS;
1850	}
1851
1852
1853	/**
1854	* Queries the successors of the basic block.
1855	*
1856	* @returns VBox status code.
1857	* @param hFlowBb The basic block handle.
1858	* @param phFlowBbFollow Where to store the handle to the basic block following
1859	* this one (optional).
1860	* @param phFlowBbTarget Where to store the handle to the basic block being the
1861	* branch target for this one (optional).
1862	*/
1863	VMMR3DECL(int) DBGFR3FlowBbQuerySuccessors(DBGFFLOWBB hFlowBb, PDBGFFLOWBB phFlowBbFollow, PDBGFFLOWBB phFlowBbTarget)
1864	{
1865	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1866	AssertPtrReturn(pFlowBb, VERR_INVALID_POINTER);
1867
1868	if ( phFlowBbFollow
1869	&& ( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND
1870	\|\| pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_COND))
1871	{
1872	DBGFADDRESS AddrStart = pFlowBb->AddrEnd;
1873	DBGFR3AddrAdd(&AddrStart, 1);
1874	int rc = DBGFR3FlowQueryBbByAddress(pFlowBb->pFlow, &AddrStart, phFlowBbFollow);
1875	AssertRC(rc);
1876	}
1877
1878	if ( phFlowBbTarget
1879	&& ( pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_JMP
1880	\|\| pFlowBb->enmEndType == DBGFFLOWBBENDTYPE_COND))
1881	{
1882	int rc = DBGFR3FlowQueryBbByAddress(pFlowBb->pFlow, &pFlowBb->AddrTarget, phFlowBbTarget);
1883	AssertRC(rc);
1884	}
1885
1886	return VINF_SUCCESS;
1887	}
1888
1889
1890	/**
1891	* Returns the number of basic blocks referencing this basic block as a target.
1892	*
1893	* @returns Number of other basic blocks referencing this one.
1894	* @param hFlowBb The basic block handle.
1895	*
1896	* @note If the given basic block references itself (loop, etc.) this will be counted as well.
1897	*/
1898	VMMR3DECL(uint32_t) DBGFR3FlowBbGetRefBbCount(DBGFFLOWBB hFlowBb)
1899	{
1900	PDBGFFLOWBBINT pFlowBb = hFlowBb;
1901	AssertPtrReturn(pFlowBb, 0);
1902
1903	uint32_t cRefsBb = 0;
1904	PDBGFFLOWBBINT pFlowBbCur;
1905	RTListForEach(&pFlowBb->pFlow->LstFlowBb, pFlowBbCur, DBGFFLOWBBINT, NdFlowBb)
1906	{
1907	if (pFlowBbCur->fFlags & DBGF_FLOW_BB_F_INCOMPLETE_ERR)
1908	continue;
1909
1910	if ( pFlowBbCur->enmEndType == DBGFFLOWBBENDTYPE_UNCOND
1911	\|\| pFlowBbCur->enmEndType == DBGFFLOWBBENDTYPE_COND)
1912	{
1913	DBGFADDRESS AddrStart = pFlowBb->AddrEnd;
1914	DBGFR3AddrAdd(&AddrStart, 1);
1915	if (dbgfR3FlowAddrEqual(&pFlowBbCur->AddrStart, &AddrStart))
1916	cRefsBb++;
1917	}
1918
1919	if ( ( pFlowBbCur->enmEndType == DBGFFLOWBBENDTYPE_UNCOND_JMP
1920	\|\| pFlowBbCur->enmEndType == DBGFFLOWBBENDTYPE_COND)
1921	&& dbgfR3FlowAddrEqual(&pFlowBbCur->AddrStart, &pFlowBb->AddrTarget))
1922	cRefsBb++;
1923	}
1924	return cRefsBb;
1925	}
1926
1927
1928	/**
1929	* Returns the basic block handles referencing the given basic block.
1930	*
1931	* @returns VBox status code.
1932	* @retval VERR_BUFFER_OVERFLOW if the array can't hold all the basic blocks.
1933	* @param hFlowBb The basic block handle.
1934	* @param paFlowBbRef Pointer to the array containing the referencing basic block handles on success.
1935	* @param cRef Number of entries in the given array.
1936	*/
1937	VMMR3DECL(int) DBGFR3FlowBbGetRefBb(DBGFFLOWBB hFlowBb, PDBGFFLOWBB paFlowBbRef, uint32_t cRef)
1938	{
1939	RT_NOREF3(hFlowBb, paFlowBbRef, cRef);
1940	return VERR_NOT_IMPLEMENTED;
1941	}
1942
1943
1944	/**
1945	* Retains a reference for the given control flow graph branch table.
1946	*
1947	* @returns new reference count.
1948	* @param hFlowBranchTbl The branch table handle.
1949	*/
1950	VMMR3DECL(uint32_t) DBGFR3FlowBranchTblRetain(DBGFFLOWBRANCHTBL hFlowBranchTbl)
1951	{
1952	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
1953	AssertPtrReturn(pFlowBranchTbl, UINT32_MAX);
1954
1955	uint32_t cRefs = ASMAtomicIncU32(&pFlowBranchTbl->cRefs);
1956	AssertMsg(cRefs > 1 && cRefs < _1M, ("%#x %p\n", cRefs, pFlowBranchTbl));
1957	return cRefs;
1958	}
1959
1960
1961	/**
1962	* Releases a given branch table handle.
1963	*
1964	* @returns the new reference count of the given branch table, on 0 it is destroyed.
1965	* @param hFlowBranchTbl The branch table handle.
1966	*/
1967	VMMR3DECL(uint32_t) DBGFR3FlowBranchTblRelease(DBGFFLOWBRANCHTBL hFlowBranchTbl)
1968	{
1969	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
1970	if (!pFlowBranchTbl)
1971	return 0;
1972	AssertPtrReturn(pFlowBranchTbl, UINT32_MAX);
1973
1974	uint32_t cRefs = ASMAtomicDecU32(&pFlowBranchTbl->cRefs);
1975	AssertMsg(cRefs < _1M, ("%#x %p\n", cRefs, pFlowBranchTbl));
1976	if (cRefs == 0)
1977	dbgfR3FlowBranchTblDestroy(pFlowBranchTbl);
1978	return cRefs;
1979	}
1980
1981
1982	/**
1983	* Return the number of slots the branch table has.
1984	*
1985	* @returns Number of slots in the branch table.
1986	* @param hFlowBranchTbl The branch table handle.
1987	*/
1988	VMMR3DECL(uint32_t) DBGFR3FlowBranchTblGetSlots(DBGFFLOWBRANCHTBL hFlowBranchTbl)
1989	{
1990	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
1991	AssertPtrReturn(pFlowBranchTbl, 0);
1992
1993	return pFlowBranchTbl->cSlots;
1994	}
1995
1996
1997	/**
1998	* Returns the start address of the branch table in the guest.
1999	*
2000	* @returns Pointer to start address of the branch table (pAddrStart).
2001	* @param hFlowBranchTbl The branch table handle.
2002	* @param pAddrStart Where to store the branch table address.
2003	*/
2004	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBranchTblGetStartAddress(DBGFFLOWBRANCHTBL hFlowBranchTbl, PDBGFADDRESS pAddrStart)
2005	{
2006	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
2007	AssertPtrReturn(pFlowBranchTbl, NULL);
2008	AssertPtrReturn(pAddrStart, NULL);
2009
2010	*pAddrStart = pFlowBranchTbl->AddrStart;
2011	return pAddrStart;
2012	}
2013
2014
2015	/**
2016	* Returns one address in the branch table at the given slot index.
2017	*
2018	* @return Pointer to the address at the given slot in the given branch table.
2019	* @param hFlowBranchTbl The branch table handle.
2020	* @param idxSlot The slot the address should be returned from.
2021	* @param pAddrSlot Where to store the address.
2022	*/
2023	VMMR3DECL(PDBGFADDRESS) DBGFR3FlowBranchTblGetAddrAtSlot(DBGFFLOWBRANCHTBL hFlowBranchTbl, uint32_t idxSlot, PDBGFADDRESS pAddrSlot)
2024	{
2025	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
2026	AssertPtrReturn(pFlowBranchTbl, NULL);
2027	AssertPtrReturn(pAddrSlot, NULL);
2028	AssertReturn(idxSlot < pFlowBranchTbl->cSlots, NULL);
2029
2030	*pAddrSlot = pFlowBranchTbl->aAddresses[idxSlot];
2031	return pAddrSlot;
2032	}
2033
2034
2035	/**
2036	* Query all addresses contained in the given branch table.
2037	*
2038	* @returns VBox status code.
2039	* @retval VERR_BUFFER_OVERFLOW if there is not enough space in the array to hold all addresses.
2040	* @param hFlowBranchTbl The branch table handle.
2041	* @param paAddrs Where to store the addresses on success.
2042	* @param cAddrs Number of entries the array can hold.
2043	*/
2044	VMMR3DECL(int) DBGFR3FlowBranchTblQueryAddresses(DBGFFLOWBRANCHTBL hFlowBranchTbl, PDBGFADDRESS paAddrs, uint32_t cAddrs)
2045	{
2046	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl = hFlowBranchTbl;
2047	AssertPtrReturn(pFlowBranchTbl, VERR_INVALID_HANDLE);
2048	AssertPtrReturn(paAddrs, VERR_INVALID_POINTER);
2049	AssertReturn(cAddrs > 0, VERR_INVALID_PARAMETER);
2050
2051	if (cAddrs < pFlowBranchTbl->cSlots)
2052	return VERR_BUFFER_OVERFLOW;
2053
2054	memcpy(paAddrs, &pFlowBranchTbl->aAddresses[0], pFlowBranchTbl->cSlots * sizeof(DBGFADDRESS));
2055	return VINF_SUCCESS;
2056	}
2057
2058
2059	/**
2060	* @callback_method_impl{FNRTSORTCMP}
2061	*/
2062	static DECLCALLBACK(int) dbgfR3FlowItSortCmp(void const pvElement1, void const pvElement2, void *pvUser)
2063	{
2064	PDBGFFLOWITORDER penmOrder = (PDBGFFLOWITORDER)pvUser;
2065	PDBGFFLOWBBINT pFlowBb1 = (PDBGFFLOWBBINT )pvElement1;
2066	PDBGFFLOWBBINT pFlowBb2 = (PDBGFFLOWBBINT )pvElement2;
2067
2068	if (dbgfR3FlowAddrEqual(&pFlowBb1->AddrStart, &pFlowBb2->AddrStart))
2069	return 0;
2070
2071	if (*penmOrder == DBGFFLOWITORDER_BY_ADDR_LOWEST_FIRST)
2072	{
2073	if (dbgfR3FlowAddrLower(&pFlowBb1->AddrStart, &pFlowBb2->AddrStart))
2074	return -1;
2075	else
2076	return 1;
2077	}
2078	else
2079	{
2080	if (dbgfR3FlowAddrLower(&pFlowBb1->AddrStart, &pFlowBb2->AddrStart))
2081	return 1;
2082	else
2083	return -1;
2084	}
2085	}
2086
2087
2088	/**
2089	* Creates a new iterator for the given control flow graph.
2090	*
2091	* @returns VBox status code.
2092	* @param hFlow The control flow graph handle.
2093	* @param enmOrder The order in which the basic blocks are enumerated.
2094	* @param phFlowIt Where to store the handle to the iterator on success.
2095	*/
2096	VMMR3DECL(int) DBGFR3FlowItCreate(DBGFFLOW hFlow, DBGFFLOWITORDER enmOrder, PDBGFFLOWIT phFlowIt)
2097	{
2098	int rc = VINF_SUCCESS;
2099	PDBGFFLOWINT pFlow = hFlow;
2100	AssertPtrReturn(pFlow, VERR_INVALID_POINTER);
2101	AssertPtrReturn(phFlowIt, VERR_INVALID_POINTER);
2102	AssertReturn(enmOrder > DBGFFLOWITORDER_INVALID && enmOrder < DBGFFLOWITORDER_BREADTH_FIRST,
2103	VERR_INVALID_PARAMETER);
2104	AssertReturn(enmOrder < DBGFFLOWITORDER_DEPTH_FRIST, VERR_NOT_IMPLEMENTED); /** @todo */
2105
2106	PDBGFFLOWITINT pIt = (PDBGFFLOWITINT)RTMemAllocZ(RT_UOFFSETOF_DYN(DBGFFLOWITINT, apBb[pFlow->cBbs]));
2107	if (RT_LIKELY(pIt))
2108	{
2109	DBGFR3FlowRetain(hFlow);
2110	pIt->pFlow = pFlow;
2111	pIt->idxBbNext = 0;
2112	/* Fill the list and then sort. */
2113	uint32_t idxBb = 0;
2114	PDBGFFLOWBBINT pFlowBb;
2115	RTListForEach(&pFlow->LstFlowBb, pFlowBb, DBGFFLOWBBINT, NdFlowBb)
2116	{
2117	DBGFR3FlowBbRetain(pFlowBb);
2118	pIt->apBb[idxBb++] = pFlowBb;
2119	}
2120
2121	/* Sort the blocks by address. */
2122	RTSortShell(&pIt->apBb[0], pFlow->cBbs, sizeof(PDBGFFLOWBBINT), dbgfR3FlowItSortCmp, &enmOrder);
2123
2124	*phFlowIt = pIt;
2125	}
2126	else
2127	rc = VERR_NO_MEMORY;
2128
2129	return rc;
2130	}
2131
2132
2133	/**
2134	* Destroys a given control flow graph iterator.
2135	*
2136	* @returns nothing.
2137	* @param hFlowIt The control flow graph iterator handle.
2138	*/
2139	VMMR3DECL(void) DBGFR3FlowItDestroy(DBGFFLOWIT hFlowIt)
2140	{
2141	PDBGFFLOWITINT pIt = hFlowIt;
2142	AssertPtrReturnVoid(pIt);
2143
2144	for (unsigned i = 0; i < pIt->pFlow->cBbs; i++)
2145	DBGFR3FlowBbRelease(pIt->apBb[i]);
2146
2147	DBGFR3FlowRelease(pIt->pFlow);
2148	RTMemFree(pIt);
2149	}
2150
2151
2152	/**
2153	* Returns the next basic block in the iterator or NULL if there is no
2154	* basic block left.
2155	*
2156	* @returns Handle to the next basic block in the iterator or NULL if the end
2157	* was reached.
2158	* @param hFlowIt The iterator handle.
2159	*
2160	* @note If a valid handle is returned it must be release with DBGFR3FlowBbRelease()
2161	* when not required anymore.
2162	*/
2163	VMMR3DECL(DBGFFLOWBB) DBGFR3FlowItNext(DBGFFLOWIT hFlowIt)
2164	{
2165	PDBGFFLOWITINT pIt = hFlowIt;
2166	AssertPtrReturn(pIt, NULL);
2167
2168	PDBGFFLOWBBINT pFlowBb = NULL;
2169	if (pIt->idxBbNext < pIt->pFlow->cBbs)
2170	{
2171	pFlowBb = pIt->apBb[pIt->idxBbNext++];
2172	DBGFR3FlowBbRetain(pFlowBb);
2173	}
2174
2175	return pFlowBb;
2176	}
2177
2178
2179	/**
2180	* Resets the given iterator to the beginning.
2181	*
2182	* @returns VBox status code.
2183	* @param hFlowIt The iterator handle.
2184	*/
2185	VMMR3DECL(int) DBGFR3FlowItReset(DBGFFLOWIT hFlowIt)
2186	{
2187	PDBGFFLOWITINT pIt = hFlowIt;
2188	AssertPtrReturn(pIt, VERR_INVALID_HANDLE);
2189
2190	pIt->idxBbNext = 0;
2191	return VINF_SUCCESS;
2192	}
2193
2194
2195	/**
2196	* @callback_method_impl{FNRTSORTCMP}
2197	*/
2198	static DECLCALLBACK(int) dbgfR3FlowBranchTblItSortCmp(void const pvElement1, void const pvElement2, void *pvUser)
2199	{
2200	PDBGFFLOWITORDER penmOrder = (PDBGFFLOWITORDER)pvUser;
2201	PDBGFFLOWBRANCHTBLINT pTbl1 = (PDBGFFLOWBRANCHTBLINT )pvElement1;
2202	PDBGFFLOWBRANCHTBLINT pTbl2 = (PDBGFFLOWBRANCHTBLINT )pvElement2;
2203
2204	if (dbgfR3FlowAddrEqual(&pTbl1->AddrStart, &pTbl2->AddrStart))
2205	return 0;
2206
2207	if (*penmOrder == DBGFFLOWITORDER_BY_ADDR_LOWEST_FIRST)
2208	{
2209	if (dbgfR3FlowAddrLower(&pTbl1->AddrStart, &pTbl2->AddrStart))
2210	return -1;
2211	else
2212	return 1;
2213	}
2214	else
2215	{
2216	if (dbgfR3FlowAddrLower(&pTbl1->AddrStart, &pTbl2->AddrStart))
2217	return 1;
2218	else
2219	return -1;
2220	}
2221	}
2222
2223
2224	/**
2225	* Creates a new branch table iterator for the given control flow graph.
2226	*
2227	* @returns VBox status code.
2228	* @param hFlow The control flow graph handle.
2229	* @param enmOrder The order in which the basic blocks are enumerated.
2230	* @param phFlowBranchTblIt Where to store the handle to the iterator on success.
2231	*/
2232	VMMR3DECL(int) DBGFR3FlowBranchTblItCreate(DBGFFLOW hFlow, DBGFFLOWITORDER enmOrder,
2233	PDBGFFLOWBRANCHTBLIT phFlowBranchTblIt)
2234	{
2235	int rc = VINF_SUCCESS;
2236	PDBGFFLOWINT pFlow = hFlow;
2237	AssertPtrReturn(pFlow, VERR_INVALID_POINTER);
2238	AssertPtrReturn(phFlowBranchTblIt, VERR_INVALID_POINTER);
2239	AssertReturn(enmOrder > DBGFFLOWITORDER_INVALID && enmOrder < DBGFFLOWITORDER_BREADTH_FIRST,
2240	VERR_INVALID_PARAMETER);
2241	AssertReturn(enmOrder < DBGFFLOWITORDER_DEPTH_FRIST, VERR_NOT_SUPPORTED);
2242
2243	PDBGFFLOWBRANCHTBLITINT pIt = (PDBGFFLOWBRANCHTBLITINT)RTMemAllocZ(RT_UOFFSETOF_DYN(DBGFFLOWBRANCHTBLITINT,
2244	apBranchTbl[pFlow->cBranchTbls]));
2245	if (RT_LIKELY(pIt))
2246	{
2247	DBGFR3FlowRetain(hFlow);
2248	pIt->pFlow = pFlow;
2249	pIt->idxTblNext = 0;
2250	/* Fill the list and then sort. */
2251	uint32_t idxTbl = 0;
2252	PDBGFFLOWBRANCHTBLINT pFlowBranchTbl;
2253	RTListForEach(&pFlow->LstBranchTbl, pFlowBranchTbl, DBGFFLOWBRANCHTBLINT, NdBranchTbl)
2254	{
2255	DBGFR3FlowBranchTblRetain(pFlowBranchTbl);
2256	pIt->apBranchTbl[idxTbl++] = pFlowBranchTbl;
2257	}
2258
2259	/* Sort the blocks by address. */
2260	RTSortShell(&pIt->apBranchTbl[0], pFlow->cBranchTbls, sizeof(PDBGFFLOWBRANCHTBLINT), dbgfR3FlowBranchTblItSortCmp, &enmOrder);
2261
2262	*phFlowBranchTblIt = pIt;
2263	}
2264	else
2265	rc = VERR_NO_MEMORY;
2266
2267	return rc;
2268	}
2269
2270
2271	/**
2272	* Destroys a given control flow graph branch table iterator.
2273	*
2274	* @returns nothing.
2275	* @param hFlowBranchTblIt The control flow graph branch table iterator handle.
2276	*/
2277	VMMR3DECL(void) DBGFR3FlowBranchTblItDestroy(DBGFFLOWBRANCHTBLIT hFlowBranchTblIt)
2278	{
2279	PDBGFFLOWBRANCHTBLITINT pIt = hFlowBranchTblIt;
2280	AssertPtrReturnVoid(pIt);
2281
2282	for (unsigned i = 0; i < pIt->pFlow->cBranchTbls; i++)
2283	DBGFR3FlowBranchTblRelease(pIt->apBranchTbl[i]);
2284
2285	DBGFR3FlowRelease(pIt->pFlow);
2286	RTMemFree(pIt);
2287	}
2288
2289
2290	/**
2291	* Returns the next branch table in the iterator or NULL if there is no
2292	* branch table left.
2293	*
2294	* @returns Handle to the next basic block in the iterator or NULL if the end
2295	* was reached.
2296	* @param hFlowBranchTblIt The iterator handle.
2297	*
2298	* @note If a valid handle is returned it must be release with DBGFR3FlowBranchTblRelease()
2299	* when not required anymore.
2300	*/
2301	VMMR3DECL(DBGFFLOWBRANCHTBL) DBGFR3FlowBranchTblItNext(DBGFFLOWBRANCHTBLIT hFlowBranchTblIt)
2302	{
2303	PDBGFFLOWBRANCHTBLITINT pIt = hFlowBranchTblIt;
2304	AssertPtrReturn(pIt, NULL);
2305
2306	PDBGFFLOWBRANCHTBLINT pTbl = NULL;
2307	if (pIt->idxTblNext < pIt->pFlow->cBranchTbls)
2308	{
2309	pTbl = pIt->apBranchTbl[pIt->idxTblNext++];
2310	DBGFR3FlowBranchTblRetain(pTbl);
2311	}
2312
2313	return pTbl;
2314	}
2315
2316
2317	/**
2318	* Resets the given iterator to the beginning.
2319	*
2320	* @returns VBox status code.
2321	* @param hFlowBranchTblIt The iterator handle.
2322	*/
2323	VMMR3DECL(int) DBGFR3FlowBranchTblItReset(DBGFFLOWBRANCHTBLIT hFlowBranchTblIt)
2324	{
2325	PDBGFFLOWBRANCHTBLITINT pIt = hFlowBranchTblIt;
2326	AssertPtrReturn(pIt, VERR_INVALID_HANDLE);
2327
2328	pIt->idxTblNext = 0;
2329	return VINF_SUCCESS;
2330	}

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/VMM/VMMR3/DBGFR3Flow.cpp@ 98103

Download in other formats: