ns_main.c

Go to the documentation of this file.

 
#include <stdint.h>
 
#include "ra8_attributes.h"
#include "ra8_err.h"
#include "ra8_nsc.h"
#include "ra8_wdt_supervisor.h"
#include "tx_api.h"
 
/* Linker symbols for BSS and Stack */
extern uint32_t g_ra8_ls_ns_bss_start;
extern uint32_t g_ra8_ls_ns_bss_end;
extern uint32_t g_ra8_ls_ns_stack_top;
extern uint32_t g_ra8_ls_ns_run_start;
 
#ifdef RA8_EREADER_NS_XIP
/* XIP-only: .data lives (writable) in SRAM but its init image is in OSPI. These
 * mark the OSPI load image (LMA) and the SRAM run bounds (VMA) so the NS reset
 * handler can copy it in -- the Secure boot no longer copies the whole image. */
extern uint32_t g_ra8_ls_ns_data_load_start;
extern uint32_t g_ra8_ls_ns_data_start;
extern uint32_t g_ra8_ls_ns_data_end;
#endif

typedef enum : uintptr_t {
  k_ns_scb_vtor_addr = 0xE000ED08U, 
} ns_scb_addr_t;

typedef enum : uint32_t {
  k_ns_ui_thread_stack_size  = 4096U, 
  k_ns_sys_thread_stack_size = 2048U, 
} ns_thread_stack_t;
 
static TX_THREAD s_ui_thread;
static TX_THREAD s_sys_thread;
 
static uint8_t s_ui_thread_stack[k_ns_ui_thread_stack_size];
static uint8_t s_sys_thread_stack[k_ns_sys_thread_stack_size];

typedef enum : uint32_t {
  k_ns_ui_heartbeat_frames = 60U, 
  k_ns_sys_heartbeat_iters = 10U, 
} ns_log_cadence_t;

typedef enum : uint32_t {
  k_ns_ui_frame_ticks = 16U,  
  k_ns_sys_poll_ticks = 100U, 
} ns_thread_sleep_t;

typedef enum : uint32_t {
  k_ns_ui_priority  = 10U, 
  k_ns_sys_priority = 15U, 
} ns_thread_prio_t;

typedef enum : uint32_t {
  k_ns_wdt_sup_stack_size  = 1024U, 
  k_ns_wdt_ui_deadline_ms  = 500U,  
  k_ns_wdt_sys_deadline_ms = 1000U, 
  k_ns_wdt_refresh_ms      = 50U,   
} ns_wdt_param_t;

typedef enum : uint32_t {
  k_ns_wdt_sup_priority = 14U, 
} ns_wdt_prio_t;

[[gnu::aligned(8)]] static uint8_t s_sup_stack[k_ns_wdt_sup_stack_size];

static uint8_t s_ui_wdt_handle = (uint8_t)k_ra8_wdt_sup_handle_invalid;
static uint8_t s_sys_wdt_handle = (uint8_t)k_ra8_wdt_sup_handle_invalid;

volatile uint32_t g_ns_ui_frames = 0U;
volatile uint32_t g_ns_sys_ticks = 0U;

extern void PendSV_Handler(void);

extern void _tx_timer_interrupt(void);
 
/* External state for the thread tick hook. */
extern volatile uint32_t g_ra8_threadx_systick_ready;

RA8_INTERNAL static void internal_systick_handler(void)
{
  if (g_ra8_threadx_systick_ready != 0U) {
    _tx_timer_interrupt();
  }
}

RA8_INTERNAL [[noreturn]] static void internal_panic_halt(void)
{
  while (1) {
    __asm__ volatile("wfi");
  }
}

RA8_INTERNAL static void internal_ui_thread_entry(ULONG thread_input)
{
  (void)thread_input;
  (void)ra8_nsc_log_emit("UI", "UI thread started");
 
  uint32_t frame = 0U;
  for (;;) {
    frame++;
    g_ns_ui_frames = frame; /* HIL liveness probe (read via J-Link). */
    /* Prove liveness to the watchdog supervisor once per frame. */
    (void)ra8_wdt_supervisor_checkin(s_ui_wdt_handle);
    if ((frame % (uint32_t)k_ns_ui_heartbeat_frames) == 0U) {
      (void)ra8_nsc_log_emit("UI", "UI loop: frame heartbeat");
    }
    tx_thread_sleep((uint32_t)k_ns_ui_frame_ticks); /* ~16 ms; yields to the others. */
  }
}

RA8_INTERNAL static void internal_sys_thread_entry(ULONG thread_input)
{
  (void)thread_input;
 
  (void)ra8_nsc_log_emit("SYS", "System thread started (storage + supervisor)");
  uint32_t tick = 0U;
  for (;;) {
    tick++;
    g_ns_sys_ticks = tick; /* HIL liveness probe (read via J-Link). */
    /* Prove liveness to the watchdog supervisor once per poll. */
    (void)ra8_wdt_supervisor_checkin(s_sys_wdt_handle);
    if ((tick % (uint32_t)k_ns_sys_heartbeat_iters) == 0U) {
      (void)ra8_nsc_log_emit("SYS", "System heartbeat: supervisor loop");
    }
    tx_thread_sleep((uint32_t)k_ns_sys_poll_ticks);
  }
}

RA8_INTERNAL static void internal_wdt_setup(void)
{
  if (ra8_nsc_wdt_start() != k_ra8_ok) {
    internal_panic_halt();
  }
  const ra8_wdt_sup_cfg_t sup_cfg = {
    .stack             = s_sup_stack,
    .stack_size_bytes  = (uint32_t)k_ns_wdt_sup_stack_size,
    .priority          = (uint32_t)k_ns_wdt_sup_priority,
    .refresh_period_ms = (uint32_t)k_ns_wdt_refresh_ms,
  };
  if (ra8_wdt_supervisor_init(&sup_cfg) != k_ra8_ok) {
    internal_panic_halt();
  }
  /* Route refresh through the NSC veneer -- the WDT is Secure-owned, so the
   * library's default direct ra8_wdt_refresh_deferred would fault in NS. */
  if (ra8_wdt_supervisor_set_refresh_hook(ra8_nsc_wdt_refresh) != k_ra8_ok) {
    internal_panic_halt();
  }
  if (ra8_wdt_supervisor_register_thread("ui",
                                         (uint32_t)k_ns_wdt_ui_deadline_ms,
                                         &s_ui_wdt_handle) != k_ra8_ok) {
    internal_panic_halt();
  }
  if (ra8_wdt_supervisor_register_thread("sys",
                                         (uint32_t)k_ns_wdt_sys_deadline_ms,
                                         &s_sys_wdt_handle) != k_ra8_ok) {
    internal_panic_halt();
  }
  if (ra8_wdt_supervisor_start() != k_ra8_ok) {
    internal_panic_halt();
  }
}

void tx_application_define(void* first_unused_memory)
{
  (void)first_unused_memory;
 
  /* Arm the WDT + start the check-in supervisor before any worker runs. */
  internal_wdt_setup();
 
  /* Create the UI thread. A failed create is unrecoverable this early: the
   * WDT supervisor already registered the "ui"/"sys" deadlines, so a missing
   * worker would only surface later as a silent watchdog boot-loop -- panic
   * now instead, like every other NS bring-up failure in this file. */
  /* (CHAR*)(uintptr_t): the vendored ThreadX API takes a non-const CHAR* for
   * the thread name; the uintptr_t hop launders the string-literal const
   * without tripping -Wcast-qual (same pattern as ra8_wdt_supervisor). */
  if (tx_thread_create(&s_ui_thread,
                       (CHAR*)(uintptr_t)"UI Thread",
                       internal_ui_thread_entry,
                       0UL,
                       s_ui_thread_stack,
                       k_ns_ui_thread_stack_size,
                       k_ns_ui_priority, /* Priority             */
                       k_ns_ui_priority, /* Preemption threshold */
                       TX_NO_TIME_SLICE,
                       TX_AUTO_START) != TX_SUCCESS) {
    internal_panic_halt();
  }
 
  /* Create the System/Storage thread */
  if (tx_thread_create(&s_sys_thread,
                       (CHAR*)(uintptr_t)"System Thread",
                       internal_sys_thread_entry,
                       0UL,
                       s_sys_thread_stack,
                       k_ns_sys_thread_stack_size,
                       k_ns_sys_priority, /* Priority             */
                       k_ns_sys_priority, /* Preemption threshold */
                       TX_NO_TIME_SLICE,
                       TX_AUTO_START) != TX_SUCCESS) {
    internal_panic_halt();
  }
}

[[noreturn]] void ns_reset_handler(void);
 
[[noreturn]] void ns_reset_handler(void)
{
#ifdef RA8_EREADER_NS_XIP
  /* XIP: code/rodata execute in place from OSPI, but .data must be writable, so
   * copy its init image from OSPI (LMA) into SRAM (VMA) before any initialised
   * global is read. Must run first -- nothing below may touch a .data global. */
  const uintptr_t data_src = (uintptr_t)&g_ra8_ls_ns_data_load_start;
  const uintptr_t data_dst = (uintptr_t)&g_ra8_ls_ns_data_start;
  const uintptr_t data_end = (uintptr_t)&g_ra8_ls_ns_data_end;
  for (uintptr_t off = 0U; (data_dst + off) < data_end; off += sizeof(uint32_t)) {
    *(volatile uint32_t*)(data_dst + off) = *(const volatile uint32_t*)(data_src + off);
  }
#endif
 
  /* Zero the NS BSS section */
  const uintptr_t bss_start = (uintptr_t)&g_ra8_ls_ns_bss_start;
  const uintptr_t bss_end   = (uintptr_t)&g_ra8_ls_ns_bss_end;
  for (uintptr_t addr = bss_start; addr < bss_end; addr += sizeof(uint32_t)) {
    *(volatile uint32_t*)addr = 0U;
  }
 
  /* Set the NS VTOR so exceptions vector correctly to NS handlers */
  *(volatile uint32_t*)k_ns_scb_vtor_addr = (uint32_t)(uintptr_t)&g_ra8_ls_ns_run_start;
 
  /* Call Secure-side substrate initialization via NSC veneer gateway */
  if (ra8_nsc_periph_init() != k_ra8_ok) {
    internal_panic_halt();
  }
 
  /* Announce the Non-Secure world is live before handing off to ThreadX.
   * Logs flow NS -> ra8_nsc_log_emit veneer -> Secure ra8_log_info -> ITM
   * (visible on the J-Link SWO console). */
  (void)ra8_nsc_log_emit("BOOT", "ra8d2-ereader: Non-Secure world online");
 
  /* Enter ThreadX RTOS kernel (never returns) */
  tx_kernel_enter();
 
  internal_panic_halt();
}
 
/* =============================================================================
 * Non-Secure Vector Table
 * =============================================================================
 */
typedef void (*ns_exc_handler_t)(void);

RA8_INTERNAL [[noreturn]] static void internal_nmi_halt(void)
{
  while (1) {
    __asm__ volatile("wfi");
  }
}
 
[[gnu::section(".ns_vectors"), gnu::used]] const ns_exc_handler_t g_ra8_ns_vector_table[16] = {
  (ns_exc_handler_t)&g_ra8_ls_ns_stack_top, /* 0 Initial MSP_NS */
  ns_reset_handler,                         /* 1 Reset          */
  internal_nmi_halt,                        /* 2 NMI            */
  internal_nmi_halt,                        /* 3 HardFault      */
  internal_nmi_halt,                        /* 4 MemManage      */
  internal_nmi_halt,                        /* 5 BusFault       */
  internal_nmi_halt,                        /* 6 UsageFault     */
  internal_nmi_halt,                        /* 7 SecureFault    */
  0,                                        /* 8 Reserved       */
  0,                                        /* 9 Reserved       */
  0,                                        /* 10 Reserved      */
  internal_nmi_halt,                        /* 11 SVCall        */
  internal_nmi_halt,                        /* 12 DebugMonitor  */
  0,                                        /* 13 Reserved      */
  PendSV_Handler,                           /* 14 PendSV        */
  internal_systick_handler,                 /* 15 SysTick       */
};