trustzone_init.c File Reference

Single-core TrustZone bring-up for a RAM-resident NS image (#60). More...

#include "trustzone_init.h"
#include <stdint.h>
#include "ra8_board_ek_ra8d2.h"
#include "ra8_cgc.h"
#include "ra8_err.h"
#include "ra8_gpio_constants.h"
#include "ra8_pin_validator.h"
#include "ra8_port_constants.h"
#include "ra8_port_utils.h"
#include "ra8_tz_secure_boot.h"

Include dependency graph for trustzone_init.c:

Go to the source code of this file.

Enumerations
enum	tz_ns_image_t : uintptr_t {   k_tz_ns_load_base = 0x02080000U ,   k_tz_ns_run_base = 0x32100000U ,   k_tz_ns_copy_size = 0x00030000U }
	Fixed NS-image addresses (two-project build, #96). More...

Functions
void	ra8_trustzone_init (void)
	Programme + enable the SAU per the partition.

Variables
uint32_t	g_ra8_ls_sgstubs_start
	Veneer-region start (NSC).
uint32_t	g_ra8_ls_sgstubs_end
	Veneer-region end (NSC).

Detailed Description

Single-core TrustZone bring-up for a RAM-resident NS image (#60).

Tag

[Ring 1 / Boot] {World: S}

The RA8 IDAU is FIXED by address bit[28] (HUM section 51.3.3.1, p3265): bit[28]=0 is Secure/NSC and the SAU cannot downgrade it, so an "NS" image at the 0x02.. / 0x22.. (bit[28]=0) aliases always executes Secure. Real NS lives at the bit[28]=1 aliases (0x12.. code, 0x32.. SRAM, 0x5.. peripherals).

Code MRAM's secure/NS split needs persistent (brick-risky) option bytes, but SRAM's split is the RUNTIME SRAMSABARn register, so the NS image is RAM-resident: flashed into Secure MRAM (the LMA) and copied by this code into the SRAM Non-secure alias 0x3210_0000 (physical SRAM2) after SRAMSABAR2 marks SRAM2 Non-secure. No option bytes, no brick.

Boot sequence (this file, all in Secure state):

1. Open PRCR_S.PRC4 and program SRAMSABAR0..3 so physical SRAM [0x10_0000, 0x18_0000) (SRAM2) is Non-secure, lower SRAM stays Secure (the Secure stack lives there). Re-lock PRC4.
2. Programme the SAU to the bit[28] model (HUM p3267): mark the IDAU-NS ranges 0x1000_0000-, 0x3000_0000-, 0x5000_0000- as NS, and one NSC region over the .gnu.sgstubs veneers in Secure MRAM. Enable SAU with ALLNS = 0 (default-deny).
3. Copy the NS image from its MRAM LMA to the SRAM NS alias.
4. BLXNS into the NS reset vector via ra8_tz_secure_boot_jump_ns.

This file does NOT use ra8_tz_secure_boot_sau_init – that function's region table is tuned for cpu1_pingpong_ipc (CPU1 is the NS core) and is shared; the bit[28] model here is app-local so that validated app is untouched. Only the generic ra8_tz_secure_boot_jump_ns primitive is reused.

On a host build (RA8_OFF_TARGET) this function is a no-op.

TrustZone Safety:

• Validates: SAU_TYPE.SREGION >= 4 before programming.
• Validates: g_ra8_ns_vector_table non-NULL + word-aligned (checked by ra8_tz_secure_boot_jump_ns).
• Trusts: the boot ROM left the SAU disabled and the IDAU in its documented reset state (fixed bit[28] split).
• Denies: treating the NS world as live on any ra8_tz_secure_boot_jump_ns return. On hardware a successful BLXNS leaves Secure thread mode and never returns; a returned denial verdict is latched in g_tz_jump_ns_err and boot falls back to the S-side main().

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file trustzone_init.c.

Enumeration Type Documentation

tz_ns_image_t

enum tz_ns_image_t : uintptr_t

Fixed NS-image addresses (two-project build, #96).

The NS image is a SEPARATE ELF (tz_nsc_cgc_usb_ns.elf), so the Secure side has none of its linker symbols. Its load (MRAM) and run (SRAM2 NS alias) bases are fixed by ns_image.ld; the Secure boot copies a fixed window large enough for the NS image (ThreadX + USBX

• ra8_usb fit well under 192 KB) and BLXNS-es to slot 1 of the NS vector table at the run base.

Invariant

Matches ORIGIN(NS_LOAD) / ORIGIN(NS_SRAM_RUN) in ns_image.ld.

Enumerator
k_tz_ns_load_base	NS image LMA (Secure MRAM).
k_tz_ns_run_base	NS image VMA (SRAM2 NS alias).
k_tz_ns_copy_size	Bytes copied LMA->VMA (192 KB).

Definition at line 86 of file trustzone_init.c.

Function Documentation

ra8_trustzone_init()

void ra8_trustzone_init

(

void

)

Programme + enable the SAU per the partition.

No-op TrustZone init for the secure-only USB experiment.

Programme the SAU + SRAM NS boundary and copy the NS image (no BLXNS).

Called from SystemInit after the cache + MPU are up but before any application code runs. When the firmware is built without RA8_TRUSTZONE_ENABLE defined this function is a no-op so the single-world build is unaffected.

Precondition

Called once from SystemInit.

Called from secure world only (the SAU registers live at 0xE000EDD0 which is not reachable from NS).

Postcondition

On success, SAU_CTRL.ENABLE is set and the four canonical regions cover NS MRAM / SRAM / SDRAM + the NSC veneer alias.

On an unusable SAU (< 4 regions) SAU_CTRL.ENABLE stays clear and the caller falls back to the single-world model.

TrustZone Safety:

• Validates: SAU_TYPE.SREGION >= 4 before programming.
• Trusts: boot ROM left SAU disabled and IDAU at reset state.
• Denies: any access to the SAU registers from NS world.

Note

Thread safety: not thread-safe; runs once at boot.

Since

0.1.0

Definition at line 611 of file trustzone_init.c.

References g_tz_jump_ns_err, internal_sau_set_region(), k_ra8_ok, k_tz_ns_run_base, ra8_boot_dsb(), ra8_boot_isb(), ra8_boot_read32(), ra8_boot_write32(), and ra8_tz_secure_boot_jump_ns().

Referenced by SystemInit().

Variable Documentation

g_ra8_ls_sgstubs_end

uint32_t g_ra8_ls_sgstubs_end

extern

Veneer-region end (NSC).

g_ra8_ls_sgstubs_start

uint32_t g_ra8_ls_sgstubs_start

extern

Veneer-region start (NSC).