QEMU tcg源码分析与unicorn原理

.global _Reset
_Reset:
 LDR sp, =stack_top
 BL c_entry
 B .

volatile unsigned int * const UART0DR = (unsigned int *)0x101f1000;
void print_uart0(const char *s) {
    while(*s != '') { /* Loop until end of string */
        *UART0DR = (unsigned int)(*s); /* Transmit char */
        s++; /* Next char */
    }
}
void c_entry() {
    print_uart0("Hello world!n");
}

ENTRY(_Reset)
SECTIONS
{
 . = 0x10000;
 .startup . : { startup.o(.text) }
 .text : { *(.text) }
 .data : { *(.data) }
 .bss : { *(.bss COMMON) }
 . = ALIGN(8);
 . = . + 0x1000; /* 4kB of stack memory */
 stack_top = .;
}

arm-none-eabi-gcc -c -mcpu=arm926ej-s -g test.c -o test.o
arm-none-eabi-as -mcpu=arm926ej-s -g startup.s -o startup.o
arm-none-eabi-ld -T test.ld test.o startup.o -o test.elf
arm-none-eabi-objcopy -O binary test.elf test.bin

qemu-system-arm -M versatilepb -m 128 -kernel test.bin -nographic

/* A very small bootloader: call the board-setup code (if needed),
 * set r0-r2, then jump to the kernel.
 * If we're not calling boot setup code then we don't copy across
 * the first BOOTLOADER_NO_BOARD_SETUP_OFFSET insns in this array.
 */
static const ARMInsnFixup bootloader[] = {
    { 0xe28fe004 }, /* add     lr, pc, #4 */
    { 0xe51ff004 }, /* ldr     pc, [pc, #-4] */
    { 0, FIXUP_BOARD_SETUP },
#define BOOTLOADER_NO_BOARD_SETUP_OFFSET 3
    { 0xe3a00000 }, /* mov     r0, #0 */
    { 0xe59f1004 }, /* ldr     r1, [pc, #4] */
    { 0xe59f2004 }, /* ldr     r2, [pc, #4] */
    { 0xe59ff004 }, /* ldr     pc, [pc, #4] */
    { 0, FIXUP_BOARDID },
    { 0, FIXUP_ARGPTR_LO },
    { 0, FIXUP_ENTRYPOINT_LO },
    { 0, FIXUP_TERMINATOR }
};

sudo apt install libcapstone-dev

qemu-system-arm -M versatilepb -m 128 -kernel test.bin -nographic -d in_asm -D in_asm.txt

qemu-system-arm -M versatilepb -m 128 -kernel test.bin -nographic -d op -D op.txt

qemu-system-arm -M versatilepb -m 128 -kernel test.bin -nographic -d out_asm -D out_asm.txt

typedef enum TCGTempKind {
    /*
     * Temp is dead at the end of the extended basic block (EBB),
     * the single-entry multiple-exit region that falls through
     * conditional branches.
     */
    TEMP_EBB,
    /* Temp is live across the entire translation block, but dead at end. */
    TEMP_TB,
    /* Temp is live across the entire translation block, and between them. */
    TEMP_GLOBAL,
    /* Temp is in a fixed register. */
    TEMP_FIXED,
    /* Temp is a fixed constant. */
    TEMP_CONST,
} TCGTempKind;

//保存callee需要保存的寄存器
0x7fffac000000:  55                       pushq    %rbp
0x7fffac000001:  53                       pushq    %rbx
0x7fffac000002:  41 54                    pushq    %r12
0x7fffac000004:  41 55                    pushq    %r13
0x7fffac000006:  41 56                    pushq    %r14
0x7fffac000008:  41 57                    pushq    %r15

//第一个参数赋值给%rbp
0x7fffac00000a:  48 8b ef                 movq     %rdi, %rbp

//预留栈空间
0x7fffac00000d:  48 81 c4 78 fb ff ff     addq     $-0x488, %rsp

//跳转到第二个参数地址处执行,第二个参数即为TranslationBlock.tc.ptr
0x7fffac000014:  ff e6                    jmpq     *%rsi

//恢复栈空间及callee需要保存的寄存器
0x7fffac000016:  33 c0                    xorl     %eax, %eax
0x7fffac000018:  48 81 c4 88 04 00 00     addq     $0x488, %rsp
0x7fffac00001f:  c5 f8 77                 vzeroupper 
0x7fffac000022:  41 5f                    popq     %r15
0x7fffac000024:  41 5e                    popq     %r14
0x7fffac000026:  41 5d                    popq     %r13
0x7fffac000028:  41 5c                    popq     %r12
0x7fffac00002a:  5b                       popq     %rbx
0x7fffac00002b:  5d                       popq     %rbp
0x7fffac00002c:  c3                       retq

mttcg_cpu_thread_fn:
    do{
        if (cpu_can_run(cpu)) {
            ...
            tcg_cpus_exec(cpu)
                cpu_exec_start(cpu)
                cpu_exec(cpu)
                    cpu_exec_enter(cpu)
                    cpu_exec_setjmp(cpu, &sc)
                        sigsetjmp(cpu->jmp_env, 0) //设置同步异常退出点
                        cpu_exec_loop(cpu, sc)
                    cpu_exec_exit(cpu)
                cpu_exec_end(cpu)
            ...
        }
    } while (!cpu->unplug || cpu_can_run(cpu));

cpu_exec_loop:
    while (!cpu_handle_exception(cpu, &ret)) { //处理同步异常
        while (!cpu_handle_interrupt(cpu, &last_tb)) { //处理异步中断
            cpu_get_tb_cpu_state()
            tb = tb_lookup() //查找tb缓存
            if (tb == NULL) {
                tb = tb_gen_code() //进行dbt转换
                    setjmp_gen_code()
                        gen_intermediate_code() //将Guest代码转换为IR
                        tcg_gen_code() //根据IR生成Host代码
            }
            tb_add_jump() //Direct block chaining优化              
            cpu_loop_exec_tb() //执行Host目标代码
        }
    }

0x00000000:  e3a00000  mov      r0, #0

---- 00000000 00000000 00000000
 mov_i32 loc5,$0x0　//0x0赋值给loc5变量
 mov_i32 r0,loc5 //loc5再赋值给r0

0x00000004:  e59f1004  ldr      r1, [pc, #4]

---- 00000004 00000000 00000e04
 add_i32 loc6,pc,$0x10   //loc6 = pc + 0x10
 mov_i32 loc9,loc6      //loc9 = loc6
 qemu_ld_i32 loc8,loc9,leul,2 //loc9处的内存加载至loc8变量,leul的含义为Little Endian unsigned long
 mov_i32 r1,loc8 //loc8赋值给r1寄存器

ts = tcg_global_reg_new_internal(s, TCG_TYPE_PTR, TCG_AREG0, "env");
cpu_env = temp_tcgv_ptr(ts);

uint32_t regs[16];

0x00000000:  e3a00000  mov      r0, #0

movl     $0, 0(%rbp)  //rbp指向CPUArchState,更新arm CPUArchState的regs[0]即r0寄存器

ldr      r2, [pc, #4]

movl     %r12d, 8(%rbp) //rbp指向CPUArchState,更新arm CPUArchState的regs[2]即r2寄存器

/* bit TARGET_LONG_BITS to TARGET_PAGE_BITS : virtual address
       bit TARGET_PAGE_BITS-1..4  : Nonzero for accesses that should not
                                    go directly to ram.
       bit 3                      : indicates that the entry is invalid
       bit 2..0                   : zero
    */

0x00000004:  e59f1004  ldr      r1, [pc, #4]

---- 00000004 00000000 00000e04
 add_i32 loc6,pc,$0x10     
 mov_i32 loc9,loc6 
 qemu_ld_i32 loc8,loc9,leul,2
 mov_i32 r1,loc8

-- guest addr 0x00000004
0x7ff9c0000119:  41 8b fc                 movl     %r12d, %edi
0x7ff9c000011c:  c1 ef 05                 shrl     $5, %edi
0x7ff9c000011f:  23 bd 10 ff ff ff        andl     -0xf0(%rbp), %edi
0x7ff9c0000125:  48 03 bd 18 ff ff ff     addq     -0xe8(%rbp), %rdi
0x7ff9c000012c:  41 8d 74 24 03           leal     3(%r12), %esi
0x7ff9c0000131:  81 e6 00 fc ff ff        andl     $0xfffffc00, %esi
0x7ff9c0000137:  3b 37                    cmpl     0(%rdi), %esi
0x7ff9c0000139:  41 8b f4                 movl     %r12d, %esi
0x7ff9c000013c:  0f 85 9c 00 00 00        jne      0x7ff9c00001de
0x7ff9c0000142:  48 03 77 10              addq     0x10(%rdi), %rsi
0x7ff9c0000146:  44 8b 26                 movl     0(%rsi), %r12d

-- guest addr 0x00000004
//r12寄存器包含着要读取的地址的低位部分addrlo(这里要读取的地址为0x10)，赋值给edi,edi为x86平台函数调用的第一个参数寄存器
0x7ff9c0000119:  41 8b fc                 movl     %r12d, %edi

//地址 >> (TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS) = 5
0x7ff9c000011c:  c1 ef 05                 shrl     $5, %edi

//-0xf0为偏移量,rbp为CPUArchState,-0xf0分为两部计算，首先获取neg.tlb.f[IDX]在CPUArchState中的偏移，再获取CPUTLBDescFast结构中mask成员的偏移, 因此-0xf0就为CPUTLBDescFast结构中mask成员的偏移,因此这条指令等于是执行了一个函数叫tlb_index(CPUArchState *env, uintptr_t mmu_idx,target_ulong addr)
0x7ff9c000011f:  23 bd 10 ff ff ff        andl     -0xf0(%rbp), %edi

//-0xe8为CPUTLBDescFast结构中的table成员的偏移，因此这条指令等于是执行了一个函数叫tlb_entry(CPUArchState *env, uintptr_t mmu_idx,target_ulong addr)
0x7ff9c0000125:  48 03 bd 18 ff ff ff     addq     -0xe8(%rbp), %rdi

//addrlo + (s_mask - a_mask)赋值给%esi, esi为x86平台函数调用的第二个参数寄存器
0x7ff9c000012c:  41 8d 74 24 03           leal     3(%r12), %esi

//地址 & (TARGET_PAGE_MASK | a_mask)这样提取出地址的除了页偏移的其他部分
0x7ff9c0000131:  81 e6 00 fc ff ff        andl     $0xfffffc00, %esi

//0(%rdi)的值为对应CPUTLBEntry的addr_read成员变量的值，和要取的地址进行比较
0x7ff9c0000137:  3b 37                    cmpl     0(%rdi), %esi

//原始地址赋值给%esi
0x7ff9c0000139:  41 8b f4                 movl     %r12d, %esi

//如果CPUTLBEntry的addr_read成员变量的值和要取的地址不相等则表示tlb不命中，跳转至tlb慢路径地址0x7ff9c00001de处执行
0x7ff9c000013c:  0f 85 9c 00 00 00        jne      0x7ff9c00001de

//如果没有进入tlb慢路径表示tlb命中，0x10(%rdi)的值为CPUTLBEntry的addend成员变量的值，加上原始地址即为HVA
0x7ff9c0000142:  48 03 77 10              addq     0x10(%rdi), %rsi

//读取HVA地址处的值并赋值给%r12d
0x7ff9c0000146:  44 8b 26                 movl     0(%rsi), %r12d

/* Generate TB finalization at the end of block */
#ifdef TCG_TARGET_NEED_LDST_LABELS
    i = tcg_out_ldst_finalize(s); 
    if (i < 0) {
        return i;

    }

-- tb slow paths + alignment
//准备好第一个参数tcg_target_call_iarg_regs[0]，它的值为CPUArchState env
0x7ff9c00001de:  48 8b fd                 movq     %rbp, %rdi

//准备好第三个参数tcg_target_call_iarg_regs[2]，它的值为TCGMemOpIdx oi = 0x22
0x7ff9c00001e1:  ba 22 00 00 00           movl     $0x22, %edx

//准备好第四个参数tcg_target_call_iarg_regs[3]，它的值为retaddr
0x7ff9c00001e6:  48 8d 0d 5c ff ff ff     leaq     -0xa4(%rip), %rcx

//调用函数helper_le_ldul_mmu
//helper_le_ldul_mmu(CPUArchState *env, target_ulong addr,TCGMemOpIdx oi, uintptr_t retaddr)
0x7ff9c00001ed:  ff 15 4d 00 00 00        callq    *0x4d(%rip)

//获取返回值
0x7ff9c00001f3:  44 8b e0                 movl     %eax, %r12d

//跳转回之前不命中的地方继续执行
0x7ff9c00001f6:  e9 4e ff ff ff           jmp      0x7ff9c0000149

    
/* If the TLB entry is for a different page, reload and try again.  */
    if (!tlb_hit(tlb_addr, addr)) {
        if (!victim_tlb_hit(env, mmu_idx, index, tlb_off,
                            addr & TARGET_PAGE_MASK)) {
            tlb_fill(env_cpu(env), addr, size,
                     access_type, mmu_idx, retaddr);
            index = tlb_index(env, mmu_idx, addr);
            entry = tlb_entry(env, mmu_idx, addr);
        }
        tlb_addr = code_read ? entry->addr_code : entry->addr_read;
        tlb_addr &= ~TLB_INVALID_MASK;
    }

0x0000000c:  e59ff004  ldr      pc, [pc, #4]

---- 0000000c 00000000 00000000
 mov_i32 tmp3,$0x18  //0x18处为pc应该更新到的值即pc + 4
 mov_i32 tmp7,tmp3    
 qemu_ld_i32 tmp6,tmp7,leul,10  //将(pc + 4)内存地址处的值取出存放于tmp6
 and_i32 pc,tmp6,$0xfffffffe　　//这里的逻辑对应于target/arm/tcg/translate.c文件的gen_bx函数,注意SPC值发生了改变
 and_i32 tmp6,tmp6,$0x1        //同样位于gen_bx函数
 st_i32 tmp6,env,$0x220        //赋值给env中的thumb成员

 //这条IR产生的原因是上面的gen_bx函数中的语句: s->base.is_jmp = DISAS_JUMP,从而退出translator_loop中的while循环，调用ops->tb_stop(db, cpu)从而调用gen_goto_ptr()产生此条IR
 call lookup_tb_ptr,$0x6,$1,tmp12,env　
 goto_ptr tmp12

call lookup_tb_ptr,$0x6,$1,tmp12,env
goto_ptr tmp12

0x7f2d53e7e1aa:  48 8b fd                 movq     %rbp, %rdi  //rbp为CPUArchState env赋值给第一个参数寄存器%rdi
//调用%eip + 0x65处的函数,即(helper_lookup_tb_ptr函数)
0x7f2d53e7e1ad:  ff 15 65 00 00 00        callq    *0x65(%rip) 
0x7f2d53e7e1b3:  ff e0                    jmpq     *%rax　//跳转至函数返回值处执行

const void *HELPER(lookup_tb_ptr)(CPUArchState *env) //它的名字经扩展后为helper_lookup_tb_ptr

0x00010004:  eb000017  bl       #0x10068

 add_i32 r14,pc,$0x8
 add_i32 pc,pc,$0x68
 goto_tb $0x0


 //0x7f666c000280即val的值为当前的TranslationBlock在buf_rx处的指针:
 //uintptr_t val = (uintptr_t)tcg_splitwx_to_rx((void *)tb) + idx;
 exit_tb $0x7f666c000280

static target_long jmp_diff(DisasContext *s, target_long diff)
{
    return diff + (s->thumb ? 4 : 8);
}

//生成的代码只是用于跳转到下一条指令
0x7fff70000397:  e9 00 00 00 00           jmp      0x7fff7000039c

static void tcg_out_goto_tb(TCGContext *s, int which)
{
    /*
     * Jump displacement must be aligned for atomic patching;
     * see if we need to add extra nops before jump
     */
    int gap = QEMU_ALIGN_PTR_UP(s->code_ptr + 1, 4) - s->code_ptr;
    if (gap != 1) {
        tcg_out_nopn(s, gap - 1);
    }
    tcg_out8(s, OPC_JMP_long); /* jmp im */
    set_jmp_insn_offset(s, which);
    tcg_out32(s, 0);
    set_jmp_reset_offset(s, which);
}

set_jmp_insn_offset(s, which); //设置当前TB的jmp_insn_offset[0]为tcg_current_code_size(s)
set_jmp_reset_offset(s, which);//设置当前TB的jmp_reset_offset[0]为tcg_current_code_size(s)

//-0x123(%rip)的值就是0x7f666c000280，赋值给%rax
0x7fff7000039c:  48 8d 05 dd fe ff ff     leaq     -0x123(%rip), %rax

//0x7fff70000018的值就是tb_ret_addr，即TB epilogue
0x7fff700003a3:  e9 70 fc ff ff           jmp      0x7fff70000018

 if (last_tb) {
    tb_add_jump(last_tb, tb_exit, tb);
 }

void tb_set_jmp_target(TranslationBlock *tb, int n, uintptr_t addr)
{
    /*
     * Get the rx view of the structure, from which we find the
     * executable code address, and tb_target_set_jmp_target can
     * produce a pc-relative displacement to jmp_target_addr[n].
     */
    const TranslationBlock *c_tb = tcg_splitwx_to_rx(tb);
    uintptr_t offset = tb->jmp_insn_offset[n];
    uintptr_t jmp_rx = (uintptr_t)tb->tc.ptr + offset;
    uintptr_t jmp_rw = jmp_rx - tcg_splitwx_diff;
    tb->jmp_target_addr[n] = addr;
    tb_target_set_jmp_target(c_tb, n, jmp_rx, jmp_rw);
}

//所有helpers的数组
static const TCGHelperInfo all_helpers[] = {
#include "exec/helper-tcg.h"   //包含#include "helper.h"
};

uint32_t HELPER(udiv)(CPUARMState *env, uint32_t num, uint32_t den)
{
    if (den == 0) {
        handle_possible_div0_trap(env, GETPC()); //引发除0异常
        return 0;
    }
    return num / den;
}

void helper_cpuid(CPUX86State *env)
{
    uint32_t eax, ebx, ecx, edx;
    cpu_svm_check_intercept_param(env, SVM_EXIT_CPUID, 0, GETPC());
    cpu_x86_cpuid(env, (uint32_t)env->regs[R_EAX], (uint32_t)env->regs[R_ECX],
                  &eax, &ebx, &ecx, &edx);
    env->regs[R_EAX] = eax;
    env->regs[R_EBX] = ebx;
    env->regs[R_ECX] = ecx;
    env->regs[R_EDX] = edx;
}

0x00010004:  ef000000  svc      #0

case DISAS_SWI:
    gen_exception(EXCP_SWI, syn_aa32_svc(dc->svc_imm, dc->thumb));

 add_i32 pc,pc,$0x8
 call exception_with_syndrome,$0x8,$0,env,$0x2,$0x46000000

//函数名称为helper_exception_with_syndrome
//excp的值为: #define EXCP_SWI  2
//syndrome的值为0x46000000,由syn_aa32_svc()函数计算得出，可以认为是常量
//target_el值为1表示执行系统调用会切换exception level至1
void HELPER(exception_with_syndrome)(CPUARMState *env, uint32_t excp,
                                     uint32_t syndrome, uint32_t target_el)
{
    raise_exception(env, excp, syndrome, target_el);
}

void raise_exception(CPUARMState *env, uint32_t excp,
                     uint32_t syndrome, uint32_t target_el)
{
    CPUState *cs = env_cpu(env);
    if (target_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
        /*
         * Redirect NS EL1 exceptions to NS EL2. These are reported with
         * their original syndrome register value, with the exception of
         * SIMD/FP access traps, which are reported as uncategorized
         * (see DDI0478C.a D1.10.4)
         */
        target_el = 2;
        if (syn_get_ec(syndrome) == EC_ADVSIMDFPACCESSTRAP) {
            syndrome = syn_uncategorized();
        }
    }
    assert(!excp_is_internal(excp));
    cs->exception_index = excp;          //更新CPU状态的异常下标
    env->exception.syndrome = syndrome;　
    env->exception.target_el = target_el;　
    cpu_loop_exit(cs);　　//请求退出执行循环
}

void cpu_loop_exit(CPUState *cpu)
{
    /* Undo the setting in cpu_tb_exec.  */
    cpu->can_do_io = 1;
    /* Undo any setting in generated code.  */
    qemu_plugin_disable_mem_helpers(cpu);
    siglongjmp(cpu->jmp_env, 1);  //执行长跳转退出至执行循环
}

cpu_exec_loop(CPUState *cpu, SyncClocks *sc)
{
    int ret;
    /* if an exception is pending, we execute it here */
    while (!cpu_handle_exception(cpu, &ret)) { //执行异常处理
        TranslationBlock *last_tb = NULL;
        int tb_exit = 0;
        while (!cpu_handle_interrupt(cpu, &last_tb)) {

void arm_cpu_do_interrupt(CPUState *cs) //逻辑是addr=8; addr += A32_BANKED_CURRENT_REG_GET(env, vbar);

env->regs[15] = newpc;  //r15就是pc寄存器

void mttcg_kick_vcpu_thread(CPUState *cpu)
{
    cpu_exit(cpu);
}

void cpu_exit(CPUState *cpu)
{
    qatomic_set(&cpu->exit_request, 1);
    /* Ensure cpu_exec will see the exit request after TCG has exited.  */
    smp_wmb();
    //Set to -1 to force TCG to stop executing linked TBs for this CPU and return to its top level loop (even in non-icount mode).
    qatomic_set(&cpu->icount_decr_ptr->u16.high, -1);
}

OP:
//开头
 ld_i32 loc3,env,$0xfffffffffffffff0  //对应于cpu->icount_decr_ptr->u16.high
 brcond_i32 loc3,$0x0,lt,$L0　//如果cpu->icount_decr_ptr->u16.high < 0则跳转至结尾处的$L0
...
//结尾
set_label $L0    
exit_tb $0x7f884c000043  //收到中断通知，退出执行循环

while (!cpu_handle_interrupt(cpu, &last_tb)) {

uc_mem_map(*uc, code_start, code_len, UC_PROT_ALL)

//返回true表示没有开启mmu
if (regime_translation_disabled(env, mmu_idx)) {

uc_hook_add(uc, &hook, UC_HOOK_CODE, my_callback,&count, 1, 0)
uc_reg_write(uc, UC_ARM_REG_R0, &r_r0)
uc_reg_write(uc, UC_ARM_REG_R2, &r_r2)
uc_emu_start(uc, code_start, code_start + sizeof(code) - 1, 0, 0)

mov r0, #1

UNICORN_DEBUG=1 ./test_arm my_hook_test

insn_idx=0 ---- 00001000 00000000 00000000
 1:  movi_i32 pc,$0x1000
 2:  movi_i32 tmp3,$0x4
 3:  movi_i64 tmp5,$0x55e38ad72840
 4:  movi_i64 tmp6,$0x1000
 5:  movi_i64 tmp7,$0x7fff1dd92190
 6:  call hookcode_4_55e38928e9a9,$0x0,$0,tmp5,tmp6,tmp3,tmp7
 7:  ld_i32 tmp3,env,$0xfffffffffffffff0
 8:  movi_i32 tmp4,$0x0
 9:  brcond_i32 tmp3,tmp4,lt,$L0
 10:  movi_i32 tmp3,$0x1
 11:  mov_i32 r0,tmp3

// Unicorn: trace this instruction on request
    if (HOOK_EXISTS_BOUNDED(s->uc, UC_HOOK_CODE, s->pc_curr)) {
        // Sync PC in advance
        gen_set_pc_im(s, s->pc_curr);

        gen_uc_tracecode(tcg_ctx, 4, UC_HOOK_CODE_IDX, s->uc, s->pc_curr);
        // the callback might want to stop emulation immediately
        check_exit_request(tcg_ctx);
    }

//将当前正在执行指令的地址放置于pc寄存器
 1:  movi_i32 pc,$0x1000

//4的值为跟踪的指令字节个数
 2:  movi_i32 tmp3,$0x4

//$0x55e38ad72840为uc_struct uc指令的值
 3:  movi_i64 tmp5,$0x55e38ad72840

//0x1000为当前pc执行的地址
 4:  movi_i64 tmp6,$0x1000

//$0x7fff1dd92190的值为设置回调时传递的user_data指针值
 5:  movi_i64 tmp7,$0x7fff1dd92190

//调用到回调函数 : void my_callback(uc_engine *uc, uint64_t address,　uint32_t size, void *user_data)
 6:  call hookcode_4_55e38928e9a9,$0x0,$0,tmp5,tmp6,tmp3,tmp7

uint8_t cpu_inb(struct uc_struct *uc, uint32_t addr)
{
    // uint8_t val;
    // address_space_read(&uc->address_space_io, addr, MEMTXATTRS_UNSPECIFIED,
    //                    &val, 1);
    //LOG_IOPORT("inb : %04"FMT_pioaddr" %02"PRIx8"n", addr, val);
    // Unicorn: call registered IN callbacks
    struct hook *hook;
    HOOK_FOREACH_VAR_DECLARE;
    HOOK_FOREACH(uc, hook, UC_HOOK_INSN) {
        if (hook->to_delete)
            continue;
        if (hook->insn == UC_X86_INS_IN)
            return ((uc_cb_insn_in_t)hook->callback)(uc, addr, 1, hook->user_data);
    }
    return 0;
}

if (HOOK_EXISTS_BOUNDED(uc, UC_HOOK_BLOCK, tb->pc)) {
        prev_op = tcg_last_op(tcg_ctx);
        block_hook = true;
        gen_uc_tracecode(tcg_ctx, 0xf8f8f8f8, UC_HOOK_BLOCK_IDX, uc, db->pc_first);
    }

// Unicorn: fast path if hookmem is not enable
    if (!HOOK_EXISTS(s->uc, UC_HOOK_MEM_READ) && !HOOK_EXISTS(s->uc, UC_HOOK_MEM_WRITE))
        //没有回调时走之前的逻辑
        tcg_out_opc(s, OPC_JCC_long + JCC_JNE, 0, 0, 0);
    else
        /* slow_path, so data access will go via load_helper() */
        tcg_out_opc(s, OPC_JMP_long, 0, 0, 0);

MemoryRegion *memory_mapping(struct uc_struct *uc, uint64_t address)

HOOK_FOREACH(uc, hook, UC_HOOK_INTR) {
            if (hook->to_delete) {
                continue;
            }
        　　//cpu->exception_index即是中断号
            ((uc_cb_hookintr_t)hook->callback)(uc, cpu->exception_index, hook->user_data);
            catched = true;
        }

static bool arm_stop_interrupt(struct uc_struct *uc, int intno)
{
    switch (intno) {
    default:
        return false;
    case EXCP_UDEF:
    case EXCP_YIELD:
        return true;
    case EXCP_INVSTATE:
        uc->invalid_error = UC_ERR_EXCEPTION;
        return true;
    }
}

HOOK_FOREACH(uc, hook, UC_HOOK_INSN_INVALID) {
            if (hook->to_delete) {
                continue;
            }
            catched = ((uc_cb_hookinsn_invalid_t)hook->callback)(uc, hook->user_data);
            if (catched) {
                break;
            }
        }