vector_table.c

Go to the documentation of this file.

 
#include <stdint.h>
 
#include "ra8_boot_entry.h"
#include "ra8_exception.h"
#include "ra8_isr.h"
 
/* =============================================================================
 * Linker-provided symbols
 * =============================================================================
 *
 * Project convention: linker symbols carry the `g_ra8_ls_` prefix so they
 * are not in the reserved leading-underscore namespace that ISO C (and
 * cert-dcl37-c / bugprone-reserved-identifier) reject. The linker script
 * in usb_cdc_echo/linker_script.ld defines them with this exact spelling.
 */
 
extern uint32_t g_ra8_ls_stack_top; 
extern uint32_t g_ra8_ls_sdata;     
extern uint32_t g_ra8_ls_edata;     
extern uint32_t g_ra8_ls_sidata;    
extern uint32_t g_ra8_ls_sbss;      
extern uint32_t g_ra8_ls_ebss;      
 
/* =============================================================================
 * Handler declarations
 * =============================================================================
 */
 
typedef void (*exc_handler_t)(void);
 
void Reset_Handler(void);
 
void HardFault_Handler(void);
 
void MemManage_Handler(void);
 
void BusFault_Handler(void);
 
void UsageFault_Handler(void);
 
/* Core exceptions (Cortex-M85). HardFault / MemManage / BusFault /
 * UsageFault each get a dedicated naked trampoline below which
 * forwards to ra8_exception_report(). The rest are weak-aliased to
 * Default_Handler and may be overridden by application code.
 *
 * Mach-O (macOS host) does not support `__attribute__((alias(...)))`.
 * On the host syntax-check / unit-test build we drop the alias and
 * keep only `weak`; the host build never branches through these
 * symbols (the firmware vector table is not exercised on the test
 * host), so we just need them to exist for the `&` references in
 * `g_ra8_vector_table_start` to be well-formed. */
#ifndef __APPLE__
[[gnu::weak, gnu::alias("Default_Handler")]] void NMI_Handler(void);
[[gnu::weak, gnu::alias("Default_Handler")]] void SecureFault_Handler(void);
[[gnu::weak, gnu::alias("Default_Handler")]] void SVC_Handler(void);
[[gnu::weak, gnu::alias("Default_Handler")]] void DebugMon_Handler(void);
[[gnu::weak, gnu::alias("Default_Handler")]] void PendSV_Handler(void);
#else
[[gnu::weak]] void NMI_Handler(void);
[[gnu::weak]] void SecureFault_Handler(void);
[[gnu::weak]] void SVC_Handler(void);
[[gnu::weak]] void DebugMon_Handler(void);
[[gnu::weak]] void PendSV_Handler(void);
#endif

extern void SysTick_Handler(void);
 
/* =============================================================================
 * Peripheral IRQ handlers
 * =============================================================================
 *
 * The RA Interrupt Control Unit exposes 112 routable interrupt lines
 * to the NVIC (per HUM table 13.x).
 *
 * Each peripheral IRQ vector forwards to ra8_isr_dispatch(slot) so any
 * (handler, ctx) registered through the substrate (ra8_isr_register)
 * runs in NVIC handler-mode. Slots that were never registered land in
 * the dispatcher's bounds-checked no-op path. The trampolines are
 * weak so a driver can still install a fully-custom IRQ handler by
 * defining a non-weak ``IRQ<n>_Handler``. HUM Ch 13 NVIC + Ch 14 ICU
 * IELSR.
 *
 * NB: a prior revision aliased every IRQn_Handler directly to
 * Default_Handler (which contains ``bkpt #0``). On debug-disabled
 * silicon a stray bkpt escalates to HardFault, so the first USB IRQ
 * after ra8_isr_register armed the NVIC line halted the chip -- this NSC
 * demo routes USBFS_INT to NVIC slot 0 (ra8_usb_device_attach), so it hit
 * exactly that. The working tz_secure_only_usb_fs / threadx_usbx_cdc_demo
 * apps use this dispatching form; this app now matches.
 */
 
enum : uint16_t {
  k_ra8_irq_count = 112U, 
};
 
/* On Apple host syntax-check we drop ra8_isr_dispatch (host build
 * never branches through these) and keep only a weak empty body. */
#ifndef __APPLE__
#define RA8_IRQ_STUB(n)                                                                            \
  void               IRQ##n##_Handler(void);                                                       \
  [[gnu::weak]] void IRQ##n##_Handler(void)                                                        \
  {                                                                                                \
    ra8_isr_dispatch((uint16_t)(n));                                                               \
  }                                                                                                \
  static_assert(1, "ra8_irq_stub_" #n)
#else
#define RA8_IRQ_STUB(n)                                                                            \
  void               IRQ##n##_Handler(void);                                                       \
  [[gnu::weak]] void IRQ##n##_Handler(void) {}                                                     \
  static_assert(1, "ra8_irq_stub_" #n)
#endif
 
RA8_IRQ_STUB(0);
RA8_IRQ_STUB(1);
RA8_IRQ_STUB(2);
RA8_IRQ_STUB(3);
RA8_IRQ_STUB(4);
RA8_IRQ_STUB(5);
RA8_IRQ_STUB(6);
RA8_IRQ_STUB(7);
RA8_IRQ_STUB(8);
RA8_IRQ_STUB(9);
RA8_IRQ_STUB(10);
RA8_IRQ_STUB(11);
RA8_IRQ_STUB(12);
RA8_IRQ_STUB(13);
RA8_IRQ_STUB(14);
RA8_IRQ_STUB(15);
RA8_IRQ_STUB(16);
RA8_IRQ_STUB(17);
RA8_IRQ_STUB(18);
RA8_IRQ_STUB(19);
RA8_IRQ_STUB(20);
RA8_IRQ_STUB(21);
RA8_IRQ_STUB(22);
RA8_IRQ_STUB(23);
RA8_IRQ_STUB(24);
RA8_IRQ_STUB(25);
RA8_IRQ_STUB(26);
RA8_IRQ_STUB(27);
RA8_IRQ_STUB(28);
RA8_IRQ_STUB(29);
RA8_IRQ_STUB(30);
RA8_IRQ_STUB(31);
RA8_IRQ_STUB(32);
RA8_IRQ_STUB(33);
RA8_IRQ_STUB(34);
RA8_IRQ_STUB(35);
RA8_IRQ_STUB(36);
RA8_IRQ_STUB(37);
RA8_IRQ_STUB(38);
RA8_IRQ_STUB(39);
RA8_IRQ_STUB(40);
RA8_IRQ_STUB(41);
RA8_IRQ_STUB(42);
RA8_IRQ_STUB(43);
RA8_IRQ_STUB(44);
RA8_IRQ_STUB(45);
RA8_IRQ_STUB(46);
RA8_IRQ_STUB(47);
RA8_IRQ_STUB(48);
RA8_IRQ_STUB(49);
RA8_IRQ_STUB(50);
RA8_IRQ_STUB(51);
RA8_IRQ_STUB(52);
RA8_IRQ_STUB(53);
RA8_IRQ_STUB(54);
RA8_IRQ_STUB(55);
RA8_IRQ_STUB(56);
RA8_IRQ_STUB(57);
RA8_IRQ_STUB(58);
RA8_IRQ_STUB(59);
RA8_IRQ_STUB(60);
RA8_IRQ_STUB(61);
RA8_IRQ_STUB(62);
RA8_IRQ_STUB(63);
RA8_IRQ_STUB(64);
RA8_IRQ_STUB(65);
RA8_IRQ_STUB(66);
RA8_IRQ_STUB(67);
RA8_IRQ_STUB(68);
RA8_IRQ_STUB(69);
RA8_IRQ_STUB(70);
RA8_IRQ_STUB(71);
RA8_IRQ_STUB(72);
RA8_IRQ_STUB(73);
RA8_IRQ_STUB(74);
RA8_IRQ_STUB(75);
RA8_IRQ_STUB(76);
RA8_IRQ_STUB(77);
RA8_IRQ_STUB(78);
RA8_IRQ_STUB(79);
RA8_IRQ_STUB(80);
RA8_IRQ_STUB(81);
RA8_IRQ_STUB(82);
RA8_IRQ_STUB(83);
RA8_IRQ_STUB(84);
RA8_IRQ_STUB(85);
RA8_IRQ_STUB(86);
RA8_IRQ_STUB(87);
RA8_IRQ_STUB(88);
RA8_IRQ_STUB(89);
RA8_IRQ_STUB(90);
RA8_IRQ_STUB(91);
RA8_IRQ_STUB(92);
RA8_IRQ_STUB(93);
RA8_IRQ_STUB(94);
RA8_IRQ_STUB(95);
RA8_IRQ_STUB(96);
RA8_IRQ_STUB(97);
RA8_IRQ_STUB(98);
RA8_IRQ_STUB(99);
RA8_IRQ_STUB(100);
RA8_IRQ_STUB(101);
RA8_IRQ_STUB(102);
RA8_IRQ_STUB(103);
RA8_IRQ_STUB(104);
RA8_IRQ_STUB(105);
RA8_IRQ_STUB(106);
RA8_IRQ_STUB(107);
RA8_IRQ_STUB(108);
RA8_IRQ_STUB(109);
RA8_IRQ_STUB(110);
RA8_IRQ_STUB(111);
 
#undef RA8_IRQ_STUB
 
/* =============================================================================
 * Vector table
 * =============================================================================
 *
 * Placed in its own section so the linker script can pin it to the
 * start of MRAM. The Cortex-M85 reads the initial MSP from offset 0
 * and the reset vector from offset 4.
 */
 
/* Mach-O `section()` requires a `"segment,section"` form, but on the
 * host syntax-check / unit-test build we only need this array to
 * exist as a normal global -- the host never reads it from a fixed
 * vector address. So drop the section pinning on Apple hosts. */
#ifndef __APPLE__
[[gnu::section(".vectors"), gnu::used]]
#else
[[gnu::used]]
#endif
const exc_handler_t g_ra8_vector_table_start[16U + k_ra8_irq_count] = {
  /* Core exceptions (slots 0..15). */
  (exc_handler_t)&g_ra8_ls_stack_top, /* 0  Initial main stack pointer. */
  Reset_Handler,                      /* 1  Reset vector.               */
  NMI_Handler,                        /* 2  NMI.                        */
  HardFault_Handler,                  /* 3  HardFault.                  */
  MemManage_Handler,                  /* 4  MemManage.                  */
  BusFault_Handler,                   /* 5  BusFault.                   */
  UsageFault_Handler,                 /* 6  UsageFault.                 */
  SecureFault_Handler,                /* 7  SecureFault.                */
  0,                                  /* 8  Reserved.                   */
  0,                                  /* 9  Reserved.                   */
  0,                                  /* 10 Reserved.                   */
  SVC_Handler,                        /* 11 SVC.                        */
  DebugMon_Handler,                   /* 12 DebugMon.                   */
  0,                                  /* 13 Reserved.                   */
  PendSV_Handler,                     /* 14 PendSV.                     */
  SysTick_Handler,                    /* 15 SysTick.                    */
 
/* Peripheral IRQs 0..111. */
#define E(n) IRQ##n##_Handler
  E(0),
  E(1),
  E(2),
  E(3),
  E(4),
  E(5),
  E(6),
  E(7),
  E(8),
  E(9),
  E(10),
  E(11),
  E(12),
  E(13),
  E(14),
  E(15),
  E(16),
  E(17),
  E(18),
  E(19),
  E(20),
  E(21),
  E(22),
  E(23),
  E(24),
  E(25),
  E(26),
  E(27),
  E(28),
  E(29),
  E(30),
  E(31),
  E(32),
  E(33),
  E(34),
  E(35),
  E(36),
  E(37),
  E(38),
  E(39),
  E(40),
  E(41),
  E(42),
  E(43),
  E(44),
  E(45),
  E(46),
  E(47),
  E(48),
  E(49),
  E(50),
  E(51),
  E(52),
  E(53),
  E(54),
  E(55),
  E(56),
  E(57),
  E(58),
  E(59),
  E(60),
  E(61),
  E(62),
  E(63),
  E(64),
  E(65),
  E(66),
  E(67),
  E(68),
  E(69),
  E(70),
  E(71),
  E(72),
  E(73),
  E(74),
  E(75),
  E(76),
  E(77),
  E(78),
  E(79),
  E(80),
  E(81),
  E(82),
  E(83),
  E(84),
  E(85),
  E(86),
  E(87),
  E(88),
  E(89),
  E(90),
  E(91),
  E(92),
  E(93),
  E(94),
  E(95),
  E(96),
  E(97),
  E(98),
  E(99),
  E(100),
  E(101),
  E(102),
  E(103),
  E(104),
  E(105),
  E(106),
  E(107),
  E(108),
  E(109),
  E(110),
  E(111),
#undef E
};
 
/* =============================================================================
 * Reset handler: copy .data from MRAM to SRAM, zero .bss, call main()
 * =============================================================================
 */

void Reset_Handler(void)
{
  /* Step 1: initialise the C runtime FIRST. SystemInit() below performs the
   * full Secure bring-up (clock tree + SAU + `ra8_trustzone_init`), and
   * ra8_trustzone_init() BLXNS-es into the Non-Secure world and never returns on
   * hardware. So the .data copy MUST run before SystemInit() -- if it ran after
   * (the classic CMSIS order) it would be dead code here, and every Secure
   * driver would execute against an uninitialised .data image (e.g. log-tag
   * pointers read as NULL, which the pin validator rejects as a null owner). */
 
  /* Copy initialized data from flash/MRAM to SRAM. */
  // NOLINTBEGIN(clang-analyzer-security.ArrayBound) -- Linker symbols define ranges, not one-element arrays.
  uint32_t* src = &g_ra8_ls_sidata;
  uint32_t* dst = &g_ra8_ls_sdata;
  while (dst < &g_ra8_ls_edata) {
    *dst++ = *src++;
  }
 
  /* Zero BSS. */
  dst = &g_ra8_ls_sbss;
  while (dst < &g_ra8_ls_ebss) {
    *dst++ = 0U;
  }
 
  // NOLINTEND(clang-analyzer-security.ArrayBound)
 
  /* Step 2: core-level init (VTOR, FPU, priority grouping, interrupts masked)
   * followed by the Secure bring-up and the BLXNS into the NS image. Safe to run
   * after the .data copy: the core steps touch no .data globals, and the Secure
   * drivers now see a fully initialised .data image. Does not return on hardware. */
  SystemInit();
 
  /* Step 3: SystemInit() does not return once it BLXNS-es into NS. Reaching here
   * means the NS transition was bypassed (e.g. a host / off-target build): fall through to
   * the Secure fallback main(), which parks the CPU. */
  main();
 
  /* main() should never return; if it does, halt. */
  while (1) {
    __asm__ volatile("wfi");
  }
}
 
/* =============================================================================
 * HardFault / MemManage / BusFault / UsageFault naked trampolines
 * =============================================================================
 *
 * Each trampoline picks the stack pointer the fault was taken on
 * (MSP if `EXC_RETURN[2]=0`, PSP otherwise), packs an `exception
 * number` in `r1`, and tail-calls `ra8_exception_report()`. See
 * `ra8_exception.h` for the frame layout and HUM reference.
 */

typedef enum : uint32_t {
  k_ra8_vector_hardfault  = 3U, 
  k_ra8_vector_memmanage  = 4U, 
  k_ra8_vector_busfault   = 5U, 
  k_ra8_vector_usagefault = 6U, 
} ra8_vector_exc_t;
 
#ifndef RA8_OFF_TARGET
[[gnu::naked, noreturn]] void HardFault_Handler(void)
{
  __asm__ volatile("tst lr, #4          \n"
                   "ite eq              \n"
                   "mrseq r0, msp       \n"
                   "mrsne r0, psp       \n"
                   "mov   r1, #3        \n"
                   "b     ra8_exception_report\n");
}

[[gnu::naked, noreturn]] void MemManage_Handler(void)
{
  __asm__ volatile("tst lr, #4          \n"
                   "ite eq              \n"
                   "mrseq r0, msp       \n"
                   "mrsne r0, psp       \n"
                   "mov   r1, #4        \n"
                   "b     ra8_exception_report\n");
}

[[gnu::naked, noreturn]] void BusFault_Handler(void)
{
  __asm__ volatile("tst lr, #4          \n"
                   "ite eq              \n"
                   "mrseq r0, msp       \n"
                   "mrsne r0, psp       \n"
                   "mov   r1, #5        \n"
                   "b     ra8_exception_report\n");
}

[[gnu::naked, noreturn]] void UsageFault_Handler(void)
{
  __asm__ volatile("tst lr, #4          \n"
                   "ite eq              \n"
                   "mrseq r0, msp       \n"
                   "mrsne r0, psp       \n"
                   "mov   r1, #6        \n"
                   "b     ra8_exception_report\n");
}
#else
/* Host build: fault handlers trap directly to the reporter. The host
 * compiler does not know `ra8_exception_report` is noreturn through
 * the extern declaration, so we add `__builtin_unreachable()` after
 * each call to keep the `noreturn` attribute on the handler valid. */
[[noreturn]] void HardFault_Handler(void)
{
  ra8_exception_report(nullptr, k_ra8_vector_hardfault);
  __builtin_unreachable();
}
[[noreturn]] void MemManage_Handler(void)
{
  ra8_exception_report(nullptr, k_ra8_vector_memmanage);
  __builtin_unreachable();
}
[[noreturn]] void BusFault_Handler(void)
{
  ra8_exception_report(nullptr, k_ra8_vector_busfault);
  __builtin_unreachable();
}
[[noreturn]] void UsageFault_Handler(void)
{
  ra8_exception_report(nullptr, k_ra8_vector_usagefault);
  __builtin_unreachable();
}
#endif
 
/* =============================================================================
 * Default trap
 * =============================================================================
 */
 
void Default_Handler(void)
{
  /* Stop here so an attached debugger can inspect stack / faults. */
#ifndef RA8_OFF_TARGET
  __asm__ volatile("bkpt #0");
  while (1) {
    __asm__ volatile("wfi");
  }
#endif
}