|
ra8-firmware 0.1.0
Bare-metal firmware for the Renesas RA8 family (RA8D2 / RA8P1)
|
Extra-MRAM (data-flash) MACI program/erase model for ra8_emulator. More...
#include <stdint.h>#include <stdio.h>#include <string.h>#include "board_periph_block.h"#include "emu_host_io_internal.h"Go to the source code of this file.
Data Structures | |
| struct | mram_state_t |
| MRAM model state: register shadow + MACI collection + counters. More... | |
Enumerations | |
| enum | mram_reg_map_t : uint64_t { k_mram_reg_base = 0x4013E000UL , k_mram_reg_span = 0x00000100UL , k_mram_off_msaddr = 0x0030UL , k_mram_off_mstatr = 0x0080UL , k_mram_off_mentryr = 0x0084UL } |
| MRMS program-mode register sub-window (ra8_flash_regs.h). More... | |
| enum | maci_map_t : uint64_t { k_maci_base = 0x40120000UL , k_maci_span = 0x00000010UL } |
| MACI command-issuing area window (ra8_flash_regs.h). More... | |
| enum | mrpgm_map_t : uint64_t { k_mrpgm_base = 0x4013F000UL , k_mrpgm_span = 0x00000100UL , k_mrpgm_words = 0x00000100UL / 4UL , k_mrpgm_off_mrcps = 0x0010UL } |
| Code-MRAM program-control sub-window (R_MRMS 0x3000 page). More... | |
| enum | mrpgm_status_t : uint8_t { k_mrcps_ready = 0x20U } |
| MRCPS ready snapshot: address buffer empty, not busy, not full, no errors. More... | |
| enum | mram_status_t : uint32_t { k_mram_mentryr_pe_bit = 0x0080U , k_mram_mstatr_mrdy = 0x00008000U , k_mram_mstatr_ilglerr = 0x00004000U , k_mram_mstatr_ilgcom = 0x00800000U } |
| Register bit values the driver polls / writes. More... | |
| enum | mram_mastat_t : uint32_t { k_mram_off_mastat = 0x0010UL , k_mram_mastat_mreae = 0x08U , k_mram_mastat_cmdlk = 0x10U } |
| MASTAT bits latched when the sequencer rejects a command. More... | |
| enum | mram_pgm_window_t : uint32_t { k_mram_pgm_lo = 0x02E07600UL , k_mram_pgm_hi = 0x02E179F0UL } |
| Legal MSADDR window for the MACI Program command (HUM Table 59.15). More... | |
| enum | maci_cmd_t : uint32_t { k_maci_cmd_program = 0xE8U , k_maci_cmd_config_set = 0x40U , k_maci_cmd_word_n = 0x08U , k_maci_cmd_final = 0xD0U } |
| MACI command opcodes the extra-MRAM program / config-set stream uses. More... | |
| enum | maci_state_t : uint8_t { k_maci_idle = 0U , k_maci_opener1 = 1U , k_maci_collect = 2U } |
| MACI collection state. More... | |
| enum | mram_lit_t : uint32_t { k_mram_reg_words = (uint32_t)(k_mram_reg_span / 4UL) , k_mram_payload_max = 32U , k_mram_byte_mask = 0xFFU , k_mram_hi_shift = 8U , k_mram_block_order = 92U } |
| Sizing + report-order constants. More... | |
Functions | |
| static RA8_INTERNAL uint64_t | internal_mram_reg_read (uc_engine *uc, uint64_t addr, unsigned size) |
| MMIO read inside the MRMS controller window. | |
| static RA8_INTERNAL void | internal_mram_reg_write (uc_engine *uc, uint64_t addr, unsigned size, uint64_t value) |
| MMIO write inside the MRMS controller window (latch MSADDR / P-E mode). | |
| static RA8_INTERNAL void | internal_maci_reject (void) |
| Latch the command-locked state the sequencer enters on rejection. | |
| static RA8_INTERNAL void | internal_maci_commit (uc_engine *uc) |
| Commit the collected command payload to the mapped MRAM region. | |
| static RA8_INTERNAL void | internal_maci_write (uc_engine *uc, uint64_t addr, unsigned size, uint64_t value) |
| MMIO write inside the MACI command-issuing area (the command stream). | |
| static RA8_INTERNAL uint64_t | internal_maci_read (uc_engine *uc, uint64_t addr, unsigned size) |
| MMIO read inside the MACI command area (driver never reads it). | |
| static RA8_INTERNAL uint64_t | internal_mrpgm_read (uc_engine *uc, uint64_t addr, unsigned size) |
| MMIO read inside the code-MRAM program-control window (MRCPS ready). | |
| static RA8_INTERNAL void | internal_mrpgm_write (uc_engine *uc, uint64_t addr, unsigned size, uint64_t value) |
| MMIO write inside the code-MRAM program-control window (shadow the gate). | |
| static RA8_INTERNAL void | internal_mram_reset (void) |
| Reset the MRAM model: clear the shadow + collection state. | |
| static RA8_INTERNAL void | internal_mram_report (void) |
| End-of-run MRAM section: MACI program-command count (only if used). | |
| static RA8_INTERNAL void | internal_mram_block_register (void) |
| Register the MRAM + MACI blocks before main (host constructor). | |
Variables | |
| static mram_state_t | s_mram |
| static const board_periph_block_t | s_k_mram_reg_block |
| MRMS controller-register block descriptor (self-registered). | |
| static const board_periph_block_t | s_k_maci_block |
| MACI command-area block descriptor (self-registered). | |
| static const board_periph_block_t | s_k_mrpgm_block |
| Code-MRAM program-control block descriptor (self-registered). | |
Extra-MRAM (data-flash) MACI program/erase model for ra8_emulator.
Models the RA8D2 MRMS controller (ra8_flash_regs.h, ra8_flash.c) just enough to make the firmware's real extra-MRAM program sequence round-trip. The firmware drives extra-MRAM writes through the MACI command sequencer rather than by storing to the region; this model intercepts that sequence:
On the 0xD0 trailer this model writes the accumulated halfword payload to the latched MSADDR via uc_mem_write. The option-setting / OTP window is host-backed by emu_memmap (it is readable on silicon, and the boot-ROM option words live there), so an accepted Program at an in-window MSADDR round-trips on the firmware's read-back. The model is deliberately faithful about the command shape: one command carries eight halfwords (16 bytes), so a caller that programs more than 16 bytes per ra8_flash_extra_mram_write call issues one command per unit. What it does NOT model is the one-time-programmable semantics – a real OTP cell cannot be erased and re-programmed, so an emulator pass for an erase/rewrite demo is optimistic pending the #315 bench answer. Before the extra-MRAM opcode fix, this model accepted ONLY the 0x40 opener, which is why ra8_emulator round-tripped the firmware's (wrong) config-set write and masked the on-silicon blank-MRAM ECC fault.
0x27000000 is an "extra-MRAM data region" the Program command can target – is false on this silicon, and modelling it as ordinary RAM is what kept ra8_io_mram_demo green here while the bench returned Error=516. HUM Ch 5 Figure 5.2 p 237 labels the Extra MRAM "(option-setting memory)"; the RA8D2 has no user EEPROM / data-flash array, and 0x2700_0000 appears nowhere in the manual. HUM Ch 59.7.4.5 Table 59.15 p 3592 enumerates every legal Program target and they all lie in 0x02E0_7600..0x02E1_79F0 (FSBL, measurement report, code certificate, general-purpose OTP, PBPS, POFSPS, REVOKE, HUK-zeroize enable, anti-rollback counter). internal_maci_commit now refuses anything outside that window and latches the command-locked state, matching a by-hand J-Link reproduction on an EK-RA8D2 (MSTATR = 0x0080C000, MASTAT = 0x18).Two register windows are intercepted (the controller block at 0x4013C000 and the MACI command area at 0x40120000); both share one module-static state.
Definition in file board_periph_mram.c.
| enum maci_cmd_t : uint32_t |
MACI command opcodes the extra-MRAM program / config-set stream uses.
Definition at line 158 of file board_periph_mram.c.
| enum maci_map_t : uint64_t |
MACI command-issuing area window (ra8_flash_regs.h).
| Enumerator | |
|---|---|
| k_maci_base | MACI command-issuing area base. |
| k_maci_span | One command port (byte+halfword). |
Definition at line 86 of file board_periph_mram.c.
| enum maci_state_t : uint8_t |
MACI collection state.
| Enumerator | |
|---|---|
| k_maci_idle | No command in progress. |
| k_maci_opener1 | Saw an opener (0xE8/0x40), expecting N. |
| k_maci_collect | Opener complete, collecting words. |
Definition at line 166 of file board_periph_mram.c.
| enum mram_lit_t : uint32_t |
Sizing + report-order constants.
| Enumerator | |
|---|---|
| k_mram_reg_words | Shadow words. |
| k_mram_payload_max | Max config-set bytes. |
| k_mram_byte_mask | One byte. |
| k_mram_hi_shift | High-byte shift. |
| k_mram_block_order | Report order slot. |
Definition at line 173 of file board_periph_mram.c.
| enum mram_mastat_t : uint32_t |
MASTAT bits latched when the sequencer rejects a command.
| Enumerator | |
|---|---|
| k_mram_off_mastat | MASTAT : extra-MRAM access status. |
| k_mram_mastat_mreae | Extra MRAM access error. |
| k_mram_mastat_cmdlk | Command-locked state latched. |
Definition at line 124 of file board_periph_mram.c.
| enum mram_pgm_window_t : uint32_t |
Legal MSADDR window for the MACI Program command (HUM Table 59.15).
HUM Ch 59.7.4.5 p 3592, Table 59.15 "Address used by Program command" enumerates every address the Program command accepts, and they are all inside the Extra MRAM option-setting memory: FSBL setting (0x02E0_7600), start address of measurement report / code certificate, general-purpose OTP, PBPS / PBPS_SEC, POFSPS, REVOKE, Zeroization HUK Enable and the anti-rollback counter setting – spanning 0x02E0_7600 to 0x02E1_79F0.
There is deliberately NO general-purpose data-flash target. HUM Ch 5 Figure 5.2 p 237 labels this region "Extra MRAM (option-setting memory)"; the RA8D2 has no user EEPROM / data-flash array, and the address 0x2700_0000 that ra8_flash_extra_mram_write targets appears nowhere in the manual. A Program aimed outside this window is rejected by the sequencer as an illegal command – bench-confirmed on an EK-RA8D2, where the by-hand sequence MSADDR=0x27000000, 0xE8, 0x08, 8x0xFFFF, 0xD0 leaves MSTATR = 0x0080C000 (ILGCOMERR | ILGLERR | MRDY) and MASTAT = 0x18 (CMDLK | MREAE).
| Enumerator | |
|---|---|
| k_mram_pgm_lo | First legal Program MSADDR. |
| k_mram_pgm_hi | Last legal Program MSADDR. |
Definition at line 152 of file board_periph_mram.c.
| enum mram_reg_map_t : uint64_t |
MRMS program-mode register sub-window (ra8_flash_regs.h).
Deliberately narrow: it covers ONLY the extra-MRAM program-mode registers (the 0x2000 page = absolute 0x4013E0xx). The 0x4013C0xx config page (MRCPFB / MRCFREQ / MREFREQ) is left to the sparse model because ra8_cgc_init programs the MRAM wait-state latches there during clock setup with a write-and-readback poll whose key-strip semantics this model does not mimic – claiming that page would break every app's boot.
Definition at line 77 of file board_periph_mram.c.
| enum mram_status_t : uint32_t |
Register bit values the driver polls / writes.
Definition at line 116 of file board_periph_mram.c.
| enum mrpgm_map_t : uint64_t |
Code-MRAM program-control sub-window (R_MRMS 0x3000 page).
The application-slot program path (ra8_flash.c, MRCPC0/1 gate + direct STR into the mapped MRAM code window + MRCFLR flush) does NOT use the MACI sequencer. It only opens the per-world program gate, stores the bytes – which Unicorn serves directly, the MRAM region is mapped read/write/exec – and then spins MRCPS for buffer-ready / commit-done before returning. Model just enough of that window to report a controller that is always idle-and-ready so the DFU code-MRAM program (dfu_selftest_*) completes instead of spinning MRCPS to its timeout. The 0x3800 ECC-config and 0x0000 wait-state pages stay sparse.
| Enumerator | |
|---|---|
| k_mrpgm_base | 0x4013C000 + 0x3000 code-MRAM P/E page. |
| k_mrpgm_span | Covers MRCPC0/1 / MRCPS / MRCFLR. |
| k_mrpgm_words | Shadow word count. |
| k_mrpgm_off_mrcps | MRCPS : Code MRAM Program Status. |
Definition at line 103 of file board_periph_mram.c.
| enum mrpgm_status_t : uint8_t |
MRCPS ready snapshot: address buffer empty, not busy, not full, no errors.
| Enumerator | |
|---|---|
| k_mrcps_ready | ABUFEMP set; PRGBSYC / ABUFFULL / error bits clear. |
Definition at line 111 of file board_periph_mram.c.
|
static |
Commit the collected command payload to the mapped MRAM region.
Commit the collected command payload to the mapped mram region; this step is contained within the board periph MRAM model and uses bounded caller or module-owned storage.
| [in,out] | uc | Unicorn engine whose emulated state is read or updated. |
Definition at line 286 of file board_periph_mram.c.
References emu_mem_write(), internal_maci_reject(), k_mram_pgm_hi, k_mram_pgm_lo, RA8_INTERNAL, and s_mram.
Referenced by internal_maci_write().
|
static |
MMIO read inside the MACI command area (driver never reads it).
MMIO read inside the maci command area (driver never reads it); this step is contained within the board periph MRAM model and uses bounded caller or module-owned storage.
| [in,out] | uc | Unicorn engine whose emulated state is read or updated. |
| [in] | addr | Guest address involved in the operation. |
| [in] | size | Size of the requested region or access in bytes. |
| value | The operation-specific maci read value. |
Definition at line 374 of file board_periph_mram.c.
References RA8_INTERNAL.
|
static |
Latch the command-locked state the sequencer enters on rejection.
HUM Ch 59.7.4.4 p 3590: once the extra-MRAM sequencer is command-locked, "MACI commands cannot be accepted" until a Status Clear or Forced Stop releases it. Sets the same bits a real rejection leaves behind so firmware reading MSTATR / MASTAT in the emulator sees the bench values.
Definition at line 268 of file board_periph_mram.c.
References k_mram_mastat_cmdlk, k_mram_mastat_mreae, k_mram_mstatr_ilgcom, k_mram_mstatr_ilglerr, k_mram_off_mastat, k_mram_off_mstatr, RA8_INTERNAL, and s_mram.
Referenced by internal_maci_commit().
|
static |
MMIO write inside the MACI command-issuing area (the command stream).
MMIO write inside the maci command-issuing area (the command stream); this step is contained within the board periph MRAM model and uses bounded caller or module-owned storage.
| [in,out] | uc | Unicorn engine whose emulated state is read or updated. |
| [in] | addr | Guest address involved in the operation. |
| [in] | size | Size of the requested region or access in bytes. |
| [in] | value | Register or payload value involved in the operation. |
Definition at line 323 of file board_periph_mram.c.
References internal_maci_commit(), k_maci_cmd_config_set, k_maci_cmd_final, k_maci_cmd_program, k_maci_cmd_word_n, k_maci_collect, k_maci_idle, k_maci_opener1, k_mram_byte_mask, k_mram_hi_shift, k_mram_payload_max, and s_mram.
|
static |
Register the MRAM + MACI blocks before main (host constructor).
Definition at line 513 of file board_periph_mram.c.
References board_periph_register_block(), RA8_INTERNAL, s_k_maci_block, s_k_mram_reg_block, and s_k_mrpgm_block.
|
static |
MMIO read inside the MRMS controller window.
MMIO read inside the mrms controller window; this step is contained within the board periph MRAM model and uses bounded caller or module-owned storage.
| [in,out] | uc | Unicorn engine whose emulated state is read or updated. |
| [in] | addr | Guest address involved in the operation. |
| [in] | size | Size of the requested region or access in bytes. |
| value | The operation-specific MRAM reg read value. |
Definition at line 209 of file board_periph_mram.c.
References k_mram_mentryr_pe_bit, k_mram_mstatr_mrdy, k_mram_off_mentryr, k_mram_off_mstatr, k_mram_reg_base, k_mram_reg_words, RA8_INTERNAL, and s_mram.
|
static |
MMIO write inside the MRMS controller window (latch MSADDR / P-E mode).
MMIO write inside the mrms controller window (latch msaddr / p-e mode); this step is contained within the board periph MRAM model and uses bounded caller or module-owned storage.
| [in,out] | uc | Unicorn engine whose emulated state is read or updated. |
| [in] | addr | Guest address involved in the operation. |
| [in] | size | Size of the requested region or access in bytes. |
| [in] | value | Register or payload value involved in the operation. |
Definition at line 239 of file board_periph_mram.c.
References k_mram_mentryr_pe_bit, k_mram_off_mentryr, k_mram_off_msaddr, k_mram_reg_base, k_mram_reg_words, and s_mram.
|
static |
End-of-run MRAM section: MACI program-command count (only if used).
End-of-run mram section: maci program-command count (only if used); this step is contained within the board periph MRAM model and uses bounded caller or module-owned storage.
Definition at line 456 of file board_periph_mram.c.
References priv_emu_io_errf(), RA8_INTERNAL, and s_mram.
|
static |
Reset the MRAM model: clear the shadow + collection state.
Reset the mram model: clear the shadow + collection state; this step is contained within the board periph MRAM model and uses bounded caller or module-owned storage.
Definition at line 443 of file board_periph_mram.c.
References memset(), RA8_INTERNAL, and s_mram.
|
static |
MMIO read inside the code-MRAM program-control window (MRCPS ready).
MMIO read inside the code-mram program-control window (mrcps ready); this step is contained within the board periph MRAM model and uses bounded caller or module-owned storage.
| [in,out] | uc | Unicorn engine whose emulated state is read or updated. |
| [in] | addr | Guest address involved in the operation. |
| [in] | size | Size of the requested region or access in bytes. |
| value | The operation-specific mrpgm read value. |
Definition at line 395 of file board_periph_mram.c.
References k_mrcps_ready, k_mrpgm_base, k_mrpgm_off_mrcps, k_mrpgm_words, RA8_INTERNAL, and s_mram.
|
static |
MMIO write inside the code-MRAM program-control window (shadow the gate).
MMIO write inside the code-mram program-control window (shadow the gate); this step is contained within the board periph MRAM model and uses bounded caller or module-owned storage.
| [in,out] | uc | Unicorn engine whose emulated state is read or updated. |
| [in] | addr | Guest address involved in the operation. |
| [in] | size | Size of the requested region or access in bytes. |
| [in] | value | Register or payload value involved in the operation. |
Definition at line 422 of file board_periph_mram.c.
References k_mrpgm_base, k_mrpgm_words, and s_mram.
|
static |
MACI command-area block descriptor (self-registered).
Definition at line 487 of file board_periph_mram.c.
Referenced by internal_mram_block_register().
|
static |
MRMS controller-register block descriptor (self-registered).
Definition at line 474 of file board_periph_mram.c.
Referenced by internal_mram_block_register().
|
static |
Code-MRAM program-control block descriptor (self-registered).
Definition at line 500 of file board_periph_mram.c.
Referenced by internal_mram_block_register().
|
static |
Definition at line 194 of file board_periph_mram.c.
Referenced by internal_maci_commit(), internal_maci_reject(), internal_maci_write(), internal_mram_reg_read(), internal_mram_reg_write(), internal_mram_report(), internal_mram_reset(), internal_mrpgm_read(), and internal_mrpgm_write().