How to emulate memory-mapped I/O

Question

I have some hardware that i want to emulate; i wonder if i can do it at a low level like this. The hardware has many registers, which i arrange in a struct:

#include <stdint.h>
struct MyControlStruct
{
    uint32_t data_reg_1;
    uint32_t data_reg_2;
    uint32_t dummy[2]; // to make the following registers have certain addresses
    uint32_t control_reg_1;
    uint32_t control_reg_2;
};
volatile struct MyControlStruct* MyDevice = (struct MyControlStruct*)0xDeadF00;

So, i want to support the following syntax for hardware access on Windows and linux:

MyDevice->data_reg_1 = 42;
MyDevice->data_reg_2 = 100;
MyDevice->control_reg_1 = 1;

When the last line of code is executed, i want the hardware emulator to "wake up" and do some stuff. Can i implement this on Windows and/or linux? I thought about somehow catching the "segmentation fault" signal, but not sure whether this can be done on Windows, or at all.

I looked at the manual page of mmap; it seems like it can help, but i couldn't understand how i can use it.

Of course, i could abstract the access to hardware by defining functions like WriteToMyDevice, and everything would be easy (maybe), but i want to understand if i can arrange access to my hardware in this exact way.

Your "low level" is too high... Both in Windows and in Linux hardware access is done from the kernel mode. You need to think about more implementation details - how to talk with hardware. For example, you can write real driver and driver emulation. — Alex F, Oct 26 '11 at 13:34
So, using pre-defined memory addresses in user mode is impossible? — anatolyg, Oct 26 '11 at 13:54
You cannot talk directly with hardware device from user mode Windows/Linux using direct memory access. This is possible only in the kernel mode. This is why I suggest you to think first about implementation details. Without them you actually don't know what to emulate. — Alex F, Oct 26 '11 at 14:09
Just one comment, mmap() won't help for your problem. It allocates a new linear address interval to your process, and links it with free page frames as needed. The way I understand what you want to do, you want a signal to be sent when one memory location in user space changes value to 1, and as Alex pointed out, I am not familiar with any easy way of doing that. — gnometorule, Oct 26 '11 at 14:38
[This][1] is how you could do it in Windows using SEH. [1]: http://stackoverflow.com/questions/8004945/how-to-catch-a-memory-write-and-call-function-with-address-of-write/8008943#8008943 — Alexey Frunze, Nov 07 '11 at 14:23

score 4 · Answer 1 · answered Oct 26 '11 at 17:05

In principle, you could code (unportably) a handler for SIGSEGV which would trap and handle access to unwanted pages, and which could check that a specified address is accessed.

To do that under Linux, you'll need to use the sigaction system call with SA_SIGINFO and use the ucontext_t* third argument of your signal handler.

This is extremely unportable: you'll have to code differently for different Unixes (perhaps even the version number of your Linux kernel could matter) and when changing processors.

And I've heard that Linux kernels are not very quick on such handling.

Other better kernels (Hurd, Plan9) offer user-level pagination, which should help.

score 2 · Answer 2 · answered Jan 12 '18 at 05:41

I initially misunderstand your question. You have a piece of memory mapped hardware and you want your emulation to be binary compatible. On Windows you could allocate the memory for the structure using VirtualAlloc and make it a guard page and catch any access to it using SEH.

Chris Stratton · Answer 3 · 2011-11-07T14:15:08.620

In actuality your emulator is (rather crudely) possible on linux with pure user space code.

To build the emulator, simply have a second thread or process (using shared memory, or perhaps an mmap'd file and inotify) watching the memory which is emulating the memory mapped device

For the real hardware driver, you will need a tiny bit of kernel code, but that could simply be something that maps the actual hardware addresses into user space with appropriate permissions. In effect this regresses a modern multiuser operating environment down to acting like an old dos box or a simple micro-controller - not great practice, but workable at least where security is not a concern.

Another thing you could consider would be running the code in a virtual machine.

If the code you will be exercising is your own, it's probably better to write it in a portable manner to begin with, abstracting out the hardware access into functions that you can re-write for each platform (ie, OS, hardware version or physical/emulated). These techniques are more useful if it's someone else's existing code you need to create an environment for. Another thing you can consider (if the original isn't too tightly integrated) is using dynamic-library level interception of specific functions, for example with LD_PRELOAD on linux or a wrapper dll on windows. Or for that matter, patching the binary.

How to emulate memory-mapped I/O

3 Answers3