trustzone_init.c File Reference

examples/ek_ra8d2/hil_needs_revalidation/cpu1_pingpong_ipc/src/trustzone_init.c More...

#include "trustzone_init.h"
#include <stdint.h>
#include "ra8_attributes.h"
#include "ra8_dual_core.h"
#include "ra8_err.h"
#include "ra8_log.h"
#include "ra8_tz_secure_boot.h"

Include dependency graph for trustzone_init.c:

Go to the source code of this file.

Enumerations
enum	cpu1_pingpong_ipc_tz_const_t : uint32_t {   k_ipcsar_value = 0x000F0303UL ,   k_ipcpar_value = 0x000F0303UL ,   k_ns_vector_table_addr = 0x02080000UL }
	Constants for the cpu1_pingpong_ipc secure boot. More...

Functions
void	ra8_trustzone_init (void)
	Programme + enable the SAU per the partition.

Variables
uint32_t	g_ra8_ls_cpu1_mram_start
uint32_t	g_ra8_ls_cpu1_stack_top
volatile uint32_t	g_cpu1_pingpong_ipc_ipcsar_post = 0U
	HIL post-secure-boot IPCSAR read-back diagnostic.
volatile uint8_t	g_cpu1_pingpong_ipc_tz_step = 0U
	Mirror of ra8_tz_secure_boot_get_step for SWD readback.
volatile uint32_t	g_cpu1_pingpong_ipc_cpu1_release_err = 0xFFFFFFFFU
	S-side CPU1 release return code captured pre-BLXNS.

Detailed Description

examples/ek_ra8d2/hil_needs_revalidation/cpu1_pingpong_ipc/src/trustzone_init.c

Per-app secure-boot wiring for cpu1_pingpong_ipc

Tag

[Ring 1 / Boot] {World: S}

Thin wrapper around libs/ra8_tz_secure_boot/ – the per-app file exists because the auto-discovery glue scans for trustzone_init.c in each example directory. The actual SAU + CPSCU + BLXNS sequence lives in ra8_tz_secure_boot_run so other apps can share it.

When RA8_TRUSTZONE_ENABLE is not defined the function is a no-op so the single-world build is unaffected. When it is defined the secure-boot:

1. Programmes the five-region SAU partition.
2. Unlocks PRCR_S.PRC4 and writes IPCSAR = 0x00050000 (SAIPCIR0 + SAIPCIR2 set) so channels 0 and 2 – the two CPU1 (always-NS) endpoints – become NS-accessible.
3. Re-locks PRCR_S.
4. BLXNS-es into the NS image starting at NS_VECTOR_TABLE, which the linker places at the NS-MRAM base (0x02080000).

Bench validation is NOT performed by this commit – a human operator with scripts/hil/recover.sh warm is the only safe path to flash the resulting image (see project_sau_sgstubs_brick).

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file trustzone_init.c.

Enumeration Type Documentation

cpu1_pingpong_ipc_tz_const_t

enum cpu1_pingpong_ipc_tz_const_t : uint32_t

Constants for the cpu1_pingpong_ipc secure boot.

• k_ipcsar_value matches the acceptance criterion of issue #22: SAIPCIR0 (bit 16) + SAIPCIR2 (bit 18) = 0x00050000.
• k_ipcpar_value stays at 0 – channels remain Privileged-only.
• k_ns_vector_table_addr is the linker-pinned start of NS MRAM where the NS image's vector table is placed.

Invariant

k_ipcsar_value must clear bits 17/19 so SAIPCIR1 and SAIPCIR3 stay Secure (CPU0 owns those channels).

See also

ra8_tz_secure_boot_run

Since

0.1.0

Enumerator
k_ipcsar_value	IPC security.
k_ipcpar_value	IPC privilege.
k_ns_vector_table_addr	NS vectors.

Definition at line 64 of file trustzone_init.c.

Function Documentation

ra8_trustzone_init()

void ra8_trustzone_init

(

void

)

Programme + enable the SAU per the partition.

No-op TrustZone init for the secure-only USB experiment.

Programme the SAU + SRAM NS boundary and copy the NS image (no BLXNS).

Called from SystemInit after the cache + MPU are up but before any application code runs. When the firmware is built without RA8_TRUSTZONE_ENABLE defined this function is a no-op so the single-world build is unaffected.

Precondition

Called once from SystemInit.

Called from secure world only (the SAU registers live at 0xE000EDD0 which is not reachable from NS).

Postcondition

On success, SAU_CTRL.ENABLE is set and the four canonical regions cover NS MRAM / SRAM / SDRAM + the NSC veneer alias.

On an unusable SAU (< 4 regions) SAU_CTRL.ENABLE stays clear and the caller falls back to the single-world model.

TrustZone Safety:

• Validates: SAU_TYPE.SREGION >= 4 before programming.
• Trusts: boot ROM left SAU disabled and IDAU at reset state.
• Denies: any access to the SAU registers from NS world.

Note

Thread safety: not thread-safe; runs once at boot.

Since

0.1.0

Definition at line 166 of file trustzone_init.c.

References g_cpu1_pingpong_ipc_ipcsar_post, g_cpu1_pingpong_ipc_tz_step, k_ipcpar_value, k_ipcsar_value, k_ns_vector_table_addr, k_ra8_ok, ra8_log_error_val, ra8_tz_secure_boot_get_step(), ra8_tz_secure_boot_jump_ns(), ra8_tz_secure_boot_sau_init(), and ra8_tz_secure_boot_security_init().

Variable Documentation

g_cpu1_pingpong_ipc_cpu1_release_err

volatile uint32_t g_cpu1_pingpong_ipc_cpu1_release_err = 0xFFFFFFFFU

S-side CPU1 release return code captured pre-BLXNS.

ra8_cpu1_release writes CPU1INITVTOR / CPU1WAITCR / CPU1ACTCSR which are all in the CPU control register block (0x4000F000). Those registers are Secure-only on this chip so the release must happen before BLXNS hands the CPU to the NS image. Bench reads this counter to confirm CPU1 was successfully released even when the NS ping-pong loop later misbehaves.

Note

Read externally by J-Link only.

Since

0.1.0

Definition at line 114 of file trustzone_init.c.

g_cpu1_pingpong_ipc_ipcsar_post

volatile uint32_t g_cpu1_pingpong_ipc_ipcsar_post = 0U

HIL post-secure-boot IPCSAR read-back diagnostic.

Bench scripts read this through SWD: it must hold 0x00050000 after the secure boot has finished. The variable is updated from within ra8_trustzone_init immediately after the IPCSAR write so a J-Link memprobe can pinpoint whether the write landed even if the BLXNS later fails.

Note

Read externally by J-Link only.

Since

0.1.0

Definition at line 84 of file trustzone_init.c.

Referenced by ra8_trustzone_init().

g_cpu1_pingpong_ipc_tz_step

volatile uint8_t g_cpu1_pingpong_ipc_tz_step = 0U

Mirror of ra8_tz_secure_boot_get_step for SWD readback.

One-shot snapshot taken inside ra8_trustzone_init for bench diagnostics. Mirrors the secure-boot library step enum (ra8_tz_secure_boot_step_t).

Note

Read externally by J-Link only.

Since

0.1.0

Definition at line 97 of file trustzone_init.c.

Referenced by ra8_trustzone_init().

g_ra8_ls_cpu1_mram_start

uint32_t g_ra8_ls_cpu1_mram_start

extern

Referenced by main().

g_ra8_ls_cpu1_stack_top

uint32_t g_ra8_ls_cpu1_stack_top

extern