emu_memmap.c

Go to the documentation of this file.

 
#include "emu_memmap.h"
 
#include <errno.h>
#include <sys/mman.h>
 
#include "emu_console.h"
#include "emu_host_io_internal.h"
#include "emu_mmio.h"
 
#ifndef MAP_ANONYMOUS
#define MAP_ANONYMOUS MAP_ANON
#endif
 
/* RA8D2 memory map (EK board) -- from the linker script / HUM R01UH1065EJ. */
static const mem_region_t s_regions[] = {
  {"ITCM", 0x00000000UL, 0x00010000UL},     /* 64 KiB tightly-coupled code */
  {"MRAM", 0x02000000UL, 0x00100000UL},     /* 1 MiB code flash + vectors  */
  {"TRIM", 0x02C1E000UL, 0x00001000UL},     /* MRAM factory-trim page: the
                                             * on-chip temperature-sensor
                                             * calibration cells (TSCDR/TSCDR2 at
                                             * 0x02C1EDA0) live here. Mapped +
                                             * seeded (see k_tsn_cal_*) so
                                             * ra8_tsn reads a real two-point pair
                                             * instead of bus-faulting on the
                                             * previously-unmapped read. */
  {"OFS_CFG", 0x02C9F000UL, 0x00001000UL},  /* Option-setting configuration words
                                             * (OFS0/1/2/3, SAS, BPS, selectors) --
                                             * HUM Ch 7 Figure 7.1 p 279, secure alias
                                             * 0x02C9_F0xx. Replaces the phantom
                                             * 0x0300A000 OFS block (#391). */
  {"OFS_OTP", 0x02E07000UL, 0x00011000UL},  /* Option-setting OTP area + the extra-MRAM
                                             * Program window: FSBL, code-cert, GPOTP,
                                             * PBPS, POFSPS, REVOKE, ZHUK, anti-rollback
                                             * (HUM Ch 59.7.4.5 Table 59.15 p 3592,
                                             * 0x02E0_7600..0x02E1_79F0). Readable on
                                             * silicon, so mapped; the MACI model
                                             * (board_periph_mram.c) lands accepted
                                             * Program payloads here. */
  {"DTCM", 0x20000000UL, 0x00010000UL},     /* 64 KiB tightly-coupled data */
  {"SRAM", 0x22000000UL, 0x001D4000UL},     /* On-chip SRAM: CPU0 bank + shared mailbox +
                                             * CPU1 bank. The extent is BENCH-MEASURED, not
                                             * assumed: over J-Link on an EK-RA8D2, words at
                                             * 0x221D0000, 0x221D2000 and 0x221D3FFC read and
                                             * write normally, while 0x221D4000 answers
                                             * "Could not read memory" and 0x221E0000 /
                                             * 0x22200000 answer "Failed to write memory".
                                             * Distinct values written at 0x22030000 and
                                             * 0x221B0000 survive independently, so the top
                                             * of the window is real memory and not an alias
                                             * of the bottom.
                                             *
                                             * This window used to be a deliberately wide
                                             * 4 MiB "so every dual-core example maps
                                             * cleanly", which made 2.2 MB of NONEXISTENT
                                             * address space silently writable here. That is
                                             * the exact defect shape that let
                                             * ota_ab_orchestration hold hw_validated while
                                             * its A/B slots went to an address the silicon
                                             * does not decode (#397): a model permissive
                                             * where the hardware is not cannot fail, so it
                                             * validates nothing. */
  {"NS_SRAM2", 0x32100000UL, 0x00080000UL}, /* SRAM2 Non-secure alias (bit[28]=1): the
                                             * TrustZone NS image run region. The Secure
                                             * boot copies the NS image here then BLXNS-es
                                             * to it; mapping it lets two-image TZ apps
                                             * run their NS world in ra8_emulator. */
  /* No DATA_FLASH region. 0x27000000 was carried in every app linker script as a
   * 16 KiB "data flash (EEPROM emulation)" MEMORY declaration inherited from
   * other RA parts, and ra8_emulator used to map it as plain RAM -- so writes there
   * succeeded in the emulator. They do not on this silicon: a J-Link
   * `w4 0x27000000` on an EK-RA8D2 answers "Failed to write memory". That gap
   * is what #397 found under ra8_io_mram_demo. #397 removed the phantom region
   * from the linker scripts and repointed the extra-MRAM constant at the real
   * option-setting window (OFS_OTP above, 0x02E0_7600); 0x27000000 stays
   * unmapped so any straggler write still faults exactly where the bench does. */
  {"SDRAM", 0x68000000UL, 0x04000000UL},    /* 64 MiB external SDRAM (Secure
                                             * physical view). Host-backed so the
                                             * NS alias below mirrors the bytes:
                                             * the GLCDC model scans the
                                             * framebuffer from here while the NS
                                             * world draws it through 0x78000000. */
  {"NS_SDRAM", 0x78000000UL, 0x04000000UL}, /* External SDRAM Non-secure alias
                                             * (IDAU bit[28]=1): the SAME 64 MiB
                                             * array as SDRAM. The Non-secure
                                             * e-reader writes framebuffer pixels
                                             * through this alias; sharing one
                                             * host mapping makes them visible to
                                             * the Secure GLCDC read at
                                             * 0x68000000. */
  {"OSPI", 0x80000000UL, 0x04000000UL},     /* 64 MiB Octo-SPI XIP flash (Secure
                                             * physical view). Memory-mapped and
                                             * executable: an NS reader image runs
                                             * execute-in-place from here. Host-
                                             * backed and shared with NS_OSPI so
                                             * the alias below mirrors the bytes. */
  {"NS_OSPI", 0x90000000UL, 0x04000000UL},  /* OSPI XIP Non-secure alias
                                             * (IDAU bit[28]=1): the SAME 64 MiB
                                             * flash array as OSPI. The XIP-linked
                                             * NS image's .text/.rodata live at
                                             * 0x90000000; the M85 fetches NS
                                             * instructions from this alias. */
  {"PPB", 0xE0000000UL, 0x00100000UL},      /* ARM private peripheral bus */
};
 
/* Octo-SPI (XSPI) execute-in-place flash window. The XSPI controller's register
 * command-engine is modelled in peripheral space (board_periph_xspi.c, base
 * 0x40268000); this is the SEPARATE memory-mapped, executable view of the 64 MiB
 * flash array the controller exposes once the firmware enters XIP mode. The
 * Secure physical window sits at 0x80000000; its TrustZone Non-secure alias
 * (IDAU bit[28]=1) sits at 0x90000000. Both views address the same flash array,
 * so ra8_emulator binds them to a single host mapping (mirrors the SRAM/NS_SRAM2
 * alias pair). A Non-secure reader image linked for XIP places .text/.rodata at
 * 0x90000000 and the CPU fetches Non-secure instructions from there. */
typedef enum : uint64_t {
  k_ospi_xip_base = 0x80000000UL, 
  k_ospi_ns_base  = 0x90000000UL, 
} ospi_xip_map_t;
 
/* On-chip temperature-sensor factory calibration. The TSN two-point trim words
 * TSCDR (code at the high reference) and TSCDR2 (code at the low reference) live
 * in the MRAM factory-trim region at 0x02C1EDA0 (HUM Ch 55.2.2 p 3498-3499).
 * Real silicon ships them factory-programmed; ra8_emulator's blank map left the
 * region unreadable, so ra8_tsn_convert_to_milli_c bus-faulted (UC_ERR_READ_-
 * UNMAPPED) reading them and adc_diag_tsn_demo aborted. Seed a deterministic,
 * plausible positive-slope pair (TSCDR @ +125C > TSCDR2 @ -40C) into the mapped
 * TRIM page after mem-map. Paired with the ADC temperature code the ADC model
 * reports (k_adc_temp_code = 1800 in board_periph_adc.c), the two-point math
 * yields ~26 degC. This is factory-constant data, not a masked poll. */
typedef enum : uint32_t {
  k_tsn_cal_addr   = 0x02C1EDA0U, 
  k_tsn_cal_tscdr  = 3000U,       
  k_tsn_cal_tscdr2 = 1000U,       
} tsn_cal_seed_t;

typedef enum : size_t {
  k_backing_sram  = 0U, 
  k_backing_sdram = 1U, 
  k_backing_ospi  = 2U, 
} backing_index_t;

typedef enum : uint64_t {
  k_sram_size       = 0x001D4000UL, 
  k_sdram_size      = 0x04000000UL, 
  k_ospi_size       = 0x04000000UL, 
  k_ns_sram2_offset = 0x00100000UL, 
  k_ns_sram2_size   = 0x00080000UL, 
  k_logical_bytes = k_sram_size + k_sdram_size + k_ospi_size,
} backing_geometry_t;

typedef enum : int {
  k_mmap_no_fd     = -1, 
  k_mmap_no_offset = 0,  
} mmap_argument_t;
 
static_assert((k_ns_sram2_offset + k_ns_sram2_size) <= k_sram_size,
              "the SRAM2 Non-secure alias must lie inside the on-chip SRAM aperture");
static_assert(k_logical_bytes == (k_sram_size + k_sdram_size + k_ospi_size),
              "the reported logical geometry must be the sum of the three apertures");

typedef struct {
  uint64_t base;    
  size_t   backing; 
  uint64_t offset;  
} aliased_window_t;

RA8_INTERNAL static emu_memmap_result_t internal_result(emu_memmap_status_t status, int os_error)
{
  return (emu_memmap_result_t){.status                = status,
                               .logical_backing_bytes = k_logical_bytes,
                               .os_error              = os_error};
}

RA8_INTERNAL static uint8_t*
internal_window_host(const emu_memmap_workspace_t* workspace, uint64_t base, uint64_t size)
{
  static const aliased_window_t k_aliased_windows[] = {
    {(uint64_t)k_sram_base, k_backing_sram, 0U},
    {(uint64_t)k_ns_sram2_base, k_backing_sram, k_ns_sram2_offset},
    {(uint64_t)k_sdram_base, k_backing_sdram, 0U},
    {(uint64_t)k_ns_sdram_base, k_backing_sdram, 0U},
    {(uint64_t)k_ospi_xip_base, k_backing_ospi, 0U},
    {(uint64_t)k_ospi_ns_base, k_backing_ospi, 0U},
  };
  for (size_t index = 0U; index < (sizeof(k_aliased_windows) / sizeof(k_aliased_windows[0]));
       index++) {
    const aliased_window_t* const window = &k_aliased_windows[index];
    if (window->base != base) {
      continue;
    }
    const emu_memmap_backing_t* const backing = &workspace->backings[window->backing];
    if ((backing->host == nullptr) || (size > backing->size) ||
        (window->offset > (backing->size - size))) {
      return nullptr;
    }
    return &backing->host[window->offset];
  }
  return nullptr;
}

RA8_INTERNAL static bool internal_backing_open(uint64_t size, emu_memmap_backing_t* backing)
{
  void* const host = mmap(nullptr,
                          (size_t)size,
                          PROT_READ | PROT_WRITE,
                          MAP_PRIVATE | MAP_ANONYMOUS,
                          (int)k_mmap_no_fd,
                          (off_t)k_mmap_no_offset);
  if (host == MAP_FAILED) {
    return false;
  }
  *backing = (emu_memmap_backing_t){.host = (uint8_t*)host, .size = size};
  return true;
}

RA8_INTERNAL static void internal_backings_close(emu_memmap_workspace_t* workspace)
{
  for (size_t index = 0U; index < k_emu_memmap_backing_count; index++) {
    emu_memmap_backing_t* const backing = &workspace->backings[index];
    if (backing->host != nullptr) {
      (void)munmap(backing->host, (size_t)backing->size);
    }
    *backing = (emu_memmap_backing_t){};
  }
}

RA8_INTERNAL static void internal_seed_tsn(uc_engine* uc)
{
  const uint32_t tscdr  = (uint32_t)k_tsn_cal_tscdr;
  const uint32_t tscdr2 = (uint32_t)k_tsn_cal_tscdr2;
  (void)emu_mem_write(uc, (uint64_t)k_tsn_cal_addr, &tscdr, sizeof(tscdr));
  (void)emu_mem_write(uc, (uint64_t)k_tsn_cal_addr + sizeof(tscdr), &tscdr2, sizeof(tscdr2));
}

RA8_INTERNAL static bool internal_map_periph_mmio(uc_engine* uc)
{
  if (uc_mmio_map(uc,
                  (uint64_t)k_periph_base,
                  (size_t)k_periph_size,
                  mmio_read,
                  nullptr,
                  mmio_write,
                  nullptr) != UC_ERR_OK) {
    (void)priv_emu_io_errf("mmio_map failed\n");
    return false;
  }
  /* IDAU bit[28]=1 Non-secure peripheral alias (0x50000000): the SAME silicon
   * registers as 0x40000000, reached by TrustZone Non-secure code (an NS image
   * built with RA8_PERIPH_NS_ALIAS -- MSTP at 0x5020_3000, USBFS at
   * 0x5025_0000, USBHS at 0x5035_1000 -- or the NS-side IPC ping-pong at
   * 0x5002_0000). The hooks rebuild the absolute address as k_periph_base +
   * window-relative offset, so a 0x50020000 access (offset 0x20000) dispatches
   * to 0x40020000 identically to a Secure one -- the exact mapping the cpu1
   * engine already carries (see cpu1_engine_init). */
  if (uc_mmio_map(uc,
                  (uint64_t)k_periph_base | (uint64_t)k_ns_alias_bit,
                  (size_t)k_periph_size,
                  mmio_read,
                  nullptr,
                  mmio_write,
                  nullptr) != UC_ERR_OK) {
    (void)priv_emu_io_errf("mmio_map (NS alias) failed\n");
    return false;
  }
  return true;
}

RA8_INTERNAL static bool internal_map_regions(const emu_memmap_workspace_t* workspace,
                                              uc_engine*                    uc)
{
  for (size_t index = 0U; index < (sizeof(s_regions) / sizeof(s_regions[0])); index++) {
    const mem_region_t* const region = &s_regions[index];
    uint8_t* const            host   = internal_window_host(workspace, region->base, region->size);
    const uc_err              mapped =
      (host != nullptr) ? uc_mem_map_ptr(uc, region->base, (size_t)region->size, UC_PROT_ALL, host)
                        : uc_mem_map(uc, region->base, (size_t)region->size, UC_PROT_ALL);
    if (mapped != UC_ERR_OK) {
      (void)priv_emu_io_errf("map %s @0x%08llX failed\n",
                             region->name,
                             (unsigned long long)region->base);
      return false;
    }
  }
  return true;
}
 
emu_memmap_result_t emu_memmap_requirements(void)
{
  return internal_result(k_emu_memmap_ok, 0);
}
 
emu_memmap_result_t emu_memmap_open(emu_memmap_workspace_t* workspace)
{
  if ((workspace == nullptr) || workspace->open) {
    return internal_result(k_emu_memmap_invalid, 0);
  }
  emu_memmap_workspace_t candidate                         = {};
  const uint64_t         sizes[k_emu_memmap_backing_count] = {
    [k_backing_sram]  = k_sram_size,
    [k_backing_sdram] = k_sdram_size,
    [k_backing_ospi]  = k_ospi_size,
  };
 
  for (size_t index = 0U; index < k_emu_memmap_backing_count; index++) {
    if (!internal_backing_open(sizes[index], &candidate.backings[index])) {
      const int failure = errno;
      internal_backings_close(&candidate);
      return internal_result(k_emu_memmap_backing, failure);
    }
  }
  candidate.open = true;
  *workspace     = candidate;
  return internal_result(k_emu_memmap_ok, 0);
}
 
emu_memmap_result_t emu_memmap_attach(emu_memmap_workspace_t* workspace, uc_engine* uc)
{
  if ((workspace == nullptr) || !workspace->open || (uc == nullptr)) {
    return internal_result(k_emu_memmap_invalid, 0);
  }
  emu_memmap_binding_t* binding = nullptr;
  for (size_t index = 0U; index < k_emu_memmap_binding_count; index++) {
    if (!workspace->bindings[index].active) {
      binding = &workspace->bindings[index];
      break;
    }
  }
  if (binding == nullptr) {
    return internal_result(k_emu_memmap_invalid, 0);
  }
  if (!internal_map_regions(workspace, uc) || !internal_map_periph_mmio(uc)) {
    return internal_result(k_emu_memmap_unicorn, 0);
  }
  *binding = (emu_memmap_binding_t){.uc = uc, .active = true};
  internal_seed_tsn(uc);
  return internal_result(k_emu_memmap_ok, 0);
}
 
bool emu_memmap_detach(emu_memmap_workspace_t* workspace, uc_engine* uc)
{
  if ((workspace == nullptr) || (uc == nullptr)) {
    return false;
  }
  for (size_t index = 0U; index < k_emu_memmap_binding_count; index++) {
    if (workspace->bindings[index].active && (workspace->bindings[index].uc == uc)) {
      workspace->bindings[index] = (emu_memmap_binding_t){};
      return true;
    }
  }
  return false;
}
 
bool emu_memmap_close(emu_memmap_workspace_t* workspace)
{
  if ((workspace == nullptr) || !workspace->open) {
    return true;
  }
  for (size_t index = 0U; index < k_emu_memmap_binding_count; index++) {
    if (workspace->bindings[index].active) {
      return false;
    }
  }
  internal_backings_close(workspace);
  *workspace = (emu_memmap_workspace_t){};
  return true;
}

const mem_region_t* emu_memmap_regions(uint32_t* count)
{
  *count = (uint32_t)(sizeof(s_regions) / sizeof(s_regions[0]));
  return s_regions;
}

uint64_t emu_memmap_mram_base(void)
{
  return s_regions[1].base;
}