question about TLB-lookups with UC_TLB_VIRTUAL / weird lookup

[kittennbfive]

Hi,

thanks for your great work.

I have noticed something i don't understand for ARM (32 bits) when using UC_TLB_VIRTUAL and code that is not located at 0x00000000.

Please consider the attached testcase.

Real output:

sim start
TLB lookup: vaddr 0x10000000 <----- that is expected
TLB lookup: vaddr 0x00000000 <----- but why this?
sim done

Why is there a TLB lookup (callback) for 0x00000000? Is this a bug or expected? I don't get it.

I am using current master compiled myself (for ARM only).

testcase.c

[PhilippTakacs]

The problem is the following line:

uc_error=uc_emu_start(uc, ADDR_CODE, sizeof(CODE_LE)-1, 0, 10);

The 3. argument is the end address not the size of the code you want to emulate. To implement this unicorne place a fake instruction after this address in the translation buffer (tb). When this instruction is hit unicorn will stop the emulation. To allow a second execution with different end address the tb is cleared after the execution. To find the corresponding tb there is an address lookup required. So to get rid of the lookup set your end address to ADDR_CODE+sizeof(CODE_LE)-1.

Just in case you missed this: the end address is the last address at which unicorn emulates your code so the special stop instruction is placed after the end address. But your last instruction is an infinite loop, so the end address will never reached.

By looking at this I found a bug: When the return value of the callback is set to vaddr != 0 the uc_emu_start returns an error. Following patch is a workaround:

diff --git a/qemu/accel/tcg/translate-all.c b/qemu/accel/tcg/translate-all.c
index 9c3955b5..f8a39fec 100644
--- a/qemu/accel/tcg/translate-all.c
+++ b/qemu/accel/tcg/translate-all.c
@@ -1132,10 +1132,14 @@ static void uc_tb_flush(struct uc_struct *uc) {
 static void uc_invalidate_tb(struct uc_struct *uc, uint64_t start_addr, size_t len) 
 {
     tb_page_addr_t start, end;
+    uint64_t invalid_addr = uc->invalid_addr;
+    int invalid_error = uc->invalid_error;
 
     uc->nested_level++;
     if (sigsetjmp(uc->jmp_bufs[uc->nested_level - 1], 0) != 0) {
         // We a get cpu fault in get_page_addr_code, ignore it.
+        uc->invalid_addr = invalid_addr;
+        uc->invalid_error = invalid_error;
         uc->nested_level--;
         return;
     }
@@ -1151,6 +1155,12 @@ static void uc_invalidate_tb(struct uc_struct *uc, uint64_t start_addr, size_t l
 
     uc->nested_level--;
 
+    if (start == -1) {
+        uc->invalid_addr = invalid_addr;
+        uc->invalid_error = invalid_error;
+	return;
+    }
+
     // For 32bit target.
     end = (start + len) & (target_ulong)(-1);
 

I need a better understanding of the tb caching to open a pr.