ra8-firmware 0.1.0
Bare-metal firmware for the Renesas RA8 family (RA8D2 / RA8P1)
Loading...
Searching...
No Matches
emu_tz.h File Reference

TrustZone Secure/Non-Secure seams for ra8_emulator. More...

#include <stdint.h>
#include <unicorn/unicorn.h>
#include "emu_elf.h"
#include "ra8_attributes.h"
Include dependency graph for emu_tz.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions

void emu_tz_install (uc_engine *uc, const emu_elf_source_t *elf)
 Arm the TrustZone S->NS boot seams (SAU_TYPE seed + BLXNS hook).
void emu_tz_patch_cmse (uc_engine *uc, const emu_elf_source_t *elf)
 Patch cmse_check_address_range to BX LR (flat-domain model).
void emu_tz_set_ns_vector_base (uint32_t base)
 Track the NS image's actual vector base (–ns load path).
uint32_t emu_tz_ns_vector_base (void)
 The tracked NS vector-table fallback base.

Detailed Description

TrustZone Secure/Non-Secure seams for ra8_emulator.

Unicorn's emulated M33 is all-Secure with no IDAU, so the Armv8-M Security Extension paths a TrustZone app takes cannot run natively. This module closes the gap in ra8_emulator's single flat domain: it seeds SAU_TYPE with the M85's region count so the Secure boot's SAU programming runs, scans ra8_tz_secure_boot_jump_ns for its BLXNS site and hand-emulates the world switch there (NS MSP/reset fetched from the live VTOR_NS or the tracked NS vector base), and patches cmse_check_address_range to BX LR so the NSC veneers' pointer range checks pass in the flat address space.

Split out of the ra8_emulator main translation unit; behaviour unchanged.

Copyright
Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT
Since
0.1.0

Definition in file emu_tz.h.

Function Documentation

◆ emu_tz_install()

void emu_tz_install ( uc_engine * uc,
const emu_elf_source_t * elf )

Arm the TrustZone S->NS boot seams (SAU_TYPE seed + BLXNS hook).

Armed whenever the firmware links the secure boot's ra8_tz_secure_boot_jump_ns: a two-image –ns app, OR a single-image app whose NS half is embedded at its MRAM LMA. The Secure boot bails to its fallback main() unless SAU_TYPE.SREGION is implemented; ra8_emulator maps the PPB as plain RAM (SAU_TYPE reads 0), so the M85's 8-region count is seeded to let the real SAU programming + NS-image copy + BLXNS run. The BLXNS site is resolved by scanning the function body and hooked so the world switch is performed by hand. Firmware without the symbol keeps its current (all-Secure) path.

Parameters
[in,out]ucActive Unicorn engine.
[in]elfOpen Secure ELF source used for symbol resolution.
Returns
Nothing.
Precondition
uc is initialised and the image is loaded.
The PPB is mapped as RAM (SAU_TYPE is seedable).
Postcondition
On a TZ image the SAU_TYPE seed + BLXNS hook are armed.
One injected error sink line reports the armed site (or the missing-BLXNS warning).
Note
Not thread-safe; call once during single-threaded setup.
Since
0.1.0

Arm the TrustZone S->NS boot seams (SAU_TYPE seed + BLXNS hook).

Definition at line 152 of file emu_tz.c.

References elf_sym_addr(), emu_mem_write(), internal_emu_tz_find_blxns(), internal_on_blxns(), k_sau_type_addr, k_sau_type_regs, k_thumb_hw_bytes, and priv_emu_io_errf().

Referenced by internal_main_install_core_seams().

◆ emu_tz_ns_vector_base()

uint32_t emu_tz_ns_vector_base ( void )

The tracked NS vector-table fallback base.

Returns
The NS vector base the BLXNS switch falls back to.
Return values
0x32100000The default RAM-resident NS run alias (never overridden).
Precondition
None.
None.
Postcondition
No state is modified.
Note
Not thread-safe; the emulator is single-threaded host-side.
Since
0.1.0

The tracked ns vector-table fallback base; this step is contained within the emu TrustZone model and uses bounded caller or module-owned storage.

Postcondition
Ownership of caller-supplied storage is unchanged.

The tracked NS vector-table fallback base.

Definition at line 228 of file emu_tz.c.

References s_ns_vector_base.

Referenced by internal_main_load_ns().

◆ emu_tz_patch_cmse()

void emu_tz_patch_cmse ( uc_engine * uc,
const emu_elf_source_t * elf )

Patch cmse_check_address_range to BX LR (flat-domain model).

The NSC veneers guard their pointer args with cmse_check_address_range(), whose TT/TTA instructions report every address as Secure on Unicorn's SAU-less core – failing the NS range check and stalling bring-up. ra8_emulator collapses the S/NS split into one flat, fully-accessible domain, so every veneer-passed pointer is valid; patching the routine's entry to BX LR returns r0 (the pointer) unchanged, i.e. "address OK". A one-time 2-byte memory patch with zero steady-state cost (a code hook would force single-stepping); absent in non-TZ firmware.

Parameters
[in,out]ucActive Unicorn engine.
[in]elfOpen Secure ELF source used for symbol resolution.
Returns
Nothing.
Precondition
The image is loaded into uc memory.
elf remains open for symbol resolution.
Postcondition
A TZ image has its range-check entry patched; others are untouched.
Note
Not thread-safe; call once during single-threaded setup.
Since
0.1.0
Postcondition
Ownership of caller-supplied storage is unchanged.

Patch cmse_check_address_range to BX LR (flat-domain model).

Definition at line 194 of file emu_tz.c.

References elf_sym_addr(), emu_mem_write(), and k_thumb_bx_lr.

Referenced by internal_main_run_loaded().

◆ emu_tz_set_ns_vector_base()

void emu_tz_set_ns_vector_base ( uint32_t base)

Track the NS image's actual vector base (–ns load path).

Parameters
[in]baseLowest executable PT_LOAD VMA of the loaded NS image.
Returns
Nothing.
Precondition
base came from elf_vector_base() on the NS image (non-zero).
Called before the run loop starts.
Postcondition
The BLXNS world switch falls back to base when VTOR_NS is unset.
Note
Not thread-safe; single-threaded setup only.
Since
0.1.0

Track the ns image's actual vector base (–ns load path); this step is contained within the emu TrustZone model and uses bounded caller or module-owned storage.

Postcondition
Ownership of caller-supplied storage is unchanged.

Track the NS image's actual vector base (–ns load path).

Definition at line 222 of file emu_tz.c.

References s_ns_vector_base.

Referenced by internal_main_load_ns().