On-silicon NIST/RFC known-answer test for the REAL crypto backend. More...

#include <stdint.h>
#include <string.h>
#include "mbedtls/memory_buffer_alloc.h"
#include "psa/crypto.h"
#include "ra8_board_ek_ra8d2.h"
#include "ra8_boot_entry.h"
#include "ra8_cgc.h"
#include "ra8_err.h"
#include "ra8_isr.h"
#include "ra8_time.h"

Include dependency graph for main.c:

Enumerations
enum	kat_const_t : uint32_t { k_kat_baud = 115200U , k_kat_period_ms = 1000U , k_kat_heap_bytes = 0x10000U }
	Demo tunables. More...
enum	kat_size_t : uint8_t { k_sha_len = 32U , k_gcm_key = 16U , k_gcm_nonce = 12U , k_gcm_pt = 64U , k_gcm_ct = 80U , k_ec_point = 65U , k_ec_sig = 64U , k_ec_coord = 32U , k_abc_len = 3U , k_smpl_len = 6U , k_hex_ten = 10U , k_hex_shift = 4U }
	Buffer/length sizing constants for the vectors. More...

Functions
static uint8_t	hex_nibble (char c)
	One hex digit -> nibble (ASCII order: '0'-'9' < 'A'-'F' < 'a'-'f').
static void	unhex (const char hex, uint8_t out, size_t n)
	Decode 2*n hex chars into out (n bytes).
static bool	kat_sha256 (void)
	FIPS 180-4 SHA-256("abc").
static bool	gcm_enc_ok (psa_key_id_t kid, const uint8_t nonce, const uint8_t pt, const uint8_t *want_ct)
	AES-128-GCM encrypt of `pt` under `kid` must equal `want_ct`.
static bool	gcm_dec_ok (psa_key_id_t kid, const uint8_t nonce, const uint8_t want_ct, const uint8_t *pt)
	AES-128-GCM decrypt of `want_ct` under `kid` must equal `pt`.
static bool	kat_aes_gcm (void)
	GCM spec Test Case 3: AES-128-GCM encrypt then decrypt round-trip.
static bool	kat_ecdsa_p256 (void)
	RFC 6979 A.2.5 ECDSA-P256/SHA-256 verify of "sample" + a tamper check.
static void	kat_panic_halt (void)
static void	kat_setup_or_halt (void)
void	main (void)
	The application entry point Reset_Handler hands control to.

Variables
static const uint8_t	k_kat_msg_ok [] = "psa crypto: KAT OK\r\n"
static const uint8_t	k_kat_msg_fail [] = "psa crypto: KAT FAIL\r\n"
static const uint8_t	k_kat_diag_boot [] = "psa: boot (console up)\r\n"
static const uint8_t	k_kat_diag_init_fail [] = "psa: crypto_init FAIL\r\n"
static const uint8_t	k_kat_diag_init_ok [] = "psa: crypto_init ok\r\n"
static uint8_t	s_kat_heap [k_kat_heap_bytes]
	Static heap tf-psa's mbedtls_calloc draws from (no libc heap on target).

Detailed Description

On-silicon NIST/RFC known-answer test for the REAL crypto backend.

Tag: [Ring 6 / APP] {World: S}

Runs the vendored TF-PSA-Crypto software backend – the exact psa_* primitives the production ra8_psa_crypto (on-target) path calls – on the real M85 and checks it against published vectors:

SHA-256("abc") FIPS 180-4
AES-128-GCM encrypt + decrypt GCM spec (McGrew/Viega) Test Case 3
ECDSA-P256 / SHA-256 verify RFC 6979 A.2.5 ("sample") + tamper

This is the on-silicon counterpart of tests/misc/src/test_psa_real_kat.c and proves that the crypto the root of trust needs actually works on hardware (the RSIP crypto hardware is non-functional; see libs/ra8_hal/src/ra8_rsip.c). Reports "psa crypto: KAT OK" / "psa crypto: KAT FAIL" over SCI8 (115200 8N1).

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Since: 0.1.0

Definition in file main.c.

Enumeration Type Documentation

◆ kat_const_t

enum kat_const_t : uint32_t

Demo tunables.

Enumerator
k_kat_baud	Kat baud.
k_kat_period_ms	Kat period ms.
k_kat_heap_bytes	64 KiB static heap for tf-psa mbedtls_calloc.

Definition at line 39 of file main.c.

◆ kat_size_t

enum kat_size_t : uint8_t

Buffer/length sizing constants for the vectors.

Enumerator
k_sha_len	SHA length.
k_gcm_key	Gcm key.
k_gcm_nonce	Gcm nonce.
k_gcm_pt	Gcm pt.
k_gcm_ct	64 ciphertext + 16 tag.
k_ec_point	0x04 \|\| X \|\| Y.
k_ec_sig	r \|\| s.
k_ec_coord	P-256 coordinate width.
k_abc_len	strlen("abc").
k_smpl_len	strlen("sample").
k_hex_ten	Hex digit A/a == 10.
k_hex_shift	High-nibble shift.

Definition at line 46 of file main.c.

Function Documentation

◆ gcm_dec_ok()

bool gcm_dec_ok	(	psa_key_id_t	kid,
		const uint8_t *	nonce,
		const uint8_t *	want_ct,
		const uint8_t *	pt )

static

AES-128-GCM decrypt of want_ct under kid must equal pt.

Definition at line 140 of file main.c.

References k_gcm_ct, k_gcm_nonce, k_gcm_pt, and memcmp().

Referenced by kat_aes_gcm().

◆ gcm_enc_ok()

bool gcm_enc_ok	(	psa_key_id_t	kid,
		const uint8_t *	nonce,
		const uint8_t *	pt,
		const uint8_t *	want_ct )

static

AES-128-GCM encrypt of pt under kid must equal want_ct.

Definition at line 115 of file main.c.

References k_gcm_ct, k_gcm_nonce, k_gcm_pt, and memcmp().

Referenced by kat_aes_gcm().

◆ hex_nibble()

uint8_t hex_nibble ( char c )

static

One hex digit -> nibble (ASCII order: '0'-'9' < 'A'-'F' < 'a'-'f').

Definition at line 73 of file main.c.

References k_hex_ten.

Referenced by unhex().

◆ kat_aes_gcm()

bool kat_aes_gcm ( void )

static

GCM spec Test Case 3: AES-128-GCM encrypt then decrypt round-trip.

Definition at line 164 of file main.c.

References gcm_dec_ok(), gcm_enc_ok(), k_gcm_ct, k_gcm_key, k_gcm_nonce, k_gcm_pt, and unhex().

Referenced by main().

◆ kat_ecdsa_p256()

bool kat_ecdsa_p256 ( void )

static

RFC 6979 A.2.5 ECDSA-P256/SHA-256 verify of "sample" + a tamper check.

Definition at line 199 of file main.c.

References k_ec_coord, k_ec_point, k_ec_sig, k_sha_len, k_smpl_len, and unhex().

Referenced by main().

◆ kat_panic_halt()

void kat_panic_halt ( void )

static

Definition at line 249 of file main.c.

Referenced by kat_setup_or_halt(), and main().

◆ kat_setup_or_halt()

void kat_setup_or_halt ( void )

static

Definition at line 256 of file main.c.

References k_kat_baud, k_kat_diag_boot, k_kat_diag_init_fail, k_kat_diag_init_ok, k_ra8_board_led1, k_ra8_board_led2, k_ra8_clock_id_cpuclk0, k_ra8_ok, kat_panic_halt(), ra8_board_led_init(), ra8_board_uart_console_init(), ra8_board_uart_console_write(), ra8_cgc_get_clock_hz(), ra8_cgc_init(), ra8_time_init(), and s_kat_heap.

Referenced by main().

◆ kat_sha256()

bool kat_sha256 ( void )

static

FIPS 180-4 SHA-256("abc").

Definition at line 97 of file main.c.

References k_abc_len, k_sha_len, memcmp(), and unhex().

Referenced by main().

◆ main()

void main ( void )

The application entry point Reset_Handler hands control to.

Returns void, not int. This is a freestanding image: there is no hosted C environment, no process and nothing to report an exit status to. ISO C fixes main at int only for a hosted implementation; for a freestanding one (C23 5.1.2.1) the startup function's name and type are implementation-defined, and this is that definition. Reset_Handler discards no value because there is none to discard, and if main ever does return, startup halts the CPU rather than resuming anything.

The firmware lane is compiled -ffreestanding (see cmake/ra8_add_app.cmake) and the flag and this signature travel together: without it both GCC and clang reject a non-int main (-Wmain / -Wmain-return-type). Do not remove one without the other.

That coupling is why the declaration sits behind __STDC_HOSTED__ == 0, which -ffreestanding sets and a hosted build does not. The guard is not defensive dressing: this header is reachable from host builds (the unit tests compile ra8_core natively), and an unguarded void main(void); makes every hosted translation unit that includes it fail with conflicting types for 'main' against its own ISO int main. The declaration therefore exists exactly where its contract does.

Hosted first-party code – everything under tests/ and tools/ – uses the ISO int main(...) contract instead, because it genuinely does run under an OS that reads the exit status. scripts/checks/check_entry_points.py holds each domain to its own contract (#707).

Declared here, once, for the same reason SystemInit is: every vector_table.c used to restate it as a local extern int32_t main(void);, sixteen copies that no compiler ever compared against the definition – and roughly thirty of them had silently drifted out of agreement with the main they called.

Precondition: Reset_Handler has copied .data and zeroed .bss.; SystemInit has configured the clock tree and VTOR.

Postcondition: Control does not return; the image runs until reset or halt.; Any value the application wanted to report has been logged, not returned.

Note: Not thread-safe; single-threaded startup context only.

Warning: Only valid while the translation unit is compiled -ffreestanding. A hosted build rejects this signature.

See also: SystemInit()

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Brings up CGC + BSP audio then plays blocks.

Precondition: Reset_Handler has copied .data and zeroed .bss.; SystemInit has set VTOR, FPU, and priority grouping.

Postcondition: On clean entry the CPU stays in the playback loop forever.; On any HAL init failure the function halts in WFI.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Brings up CGC + GPT triple, runs sweep.

Precondition: Reset_Handler has copied .data and zeroed .bss.; SystemInit has set VTOR, FPU, and priority grouping.

Postcondition: On clean entry the CPU stays in the sweep loop forever.; On any HAL init failure the function halts in WFI.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Brings up clocks + UART + RMII pins, then ThreadX.

Precondition: Reset_Handler has copied .data and zeroed .bss.

Postcondition: On clean entry the kernel runs the worker thread once.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Brings up clocks + UART, then enters ThreadX.

Precondition: Reset_Handler has copied .data and zeroed .bss.; SystemInit has set VTOR, FPU, and priority grouping.

Postcondition: On clean entry the kernel runs the worker thread forever.; On any HAL init failure the function halts in WFI.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Brings up LED, console, SDHI pins, then ThreadX.

Precondition: Reset_Handler has copied .data + zeroed .bss.; SystemInit has set VTOR, FPU, and priority grouping.

Postcondition: CPUCLK0 is raised to the PLL1 target before the kernel starts.; On clean entry the SD card thread runs forever.; On any HAL init failure the function halts in __WFI.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Brings up CGC + USB-FS + UAC1, then enters the iso-IN feed loop forever.

Precondition: Reset_Handler has copied .data and zeroed .bss.; SystemInit has set VTOR, FPU, and priority grouping.

Postcondition: On clean entry the CPU stays in the iso-IN feed loop forever.; On any HAL init failure the function halts in WFI.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Precondition: SystemInit set VTOR / FPU / priority grouping.

The application entry point Reset_Handler hands control to.

See file header.

Precondition: Boot init has completed.; The secure-boot library's BLXNS into NS image either failed or was skipped (the call site in ra8_trustzone_init is a no-op on host builds).

Postcondition: Diagnostic counter latched, CPU parked in a halt loop.; Function never returns.

Note: Single-threaded entry.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Precondition: Reset_Handler copied .data and zeroed .bss.; SystemInit set VTOR / FPU / priority grouping.

Postcondition: On success g_eoh_chapters / g_eoh_crc hold the parsed results, the banner is emitted, and g_eoh_heartbeat advances once per frame.; On any failure g_eoh_err is non-zero and the CPU parks (no heartbeat).

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Precondition: Reset_Handler copied .data and zeroed .bss.; SystemInit set VTOR / FPU / priority grouping.

Postcondition: The chapters/ch0-CRC banner is emitted; the CPU then loops in WFI.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Precondition: Reset_Handler copied .data and zeroed .bss.; SystemInit set VTOR / FPU / priority grouping.

Postcondition: On success the g_etoc_* result globals hold the parsed TOC values, the banner is emitted, and g_etoc_heartbeat advances once per frame.; On any failure g_etoc_err is non-zero and the CPU parks (no heartbeat).

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Precondition: Reset_Handler copied .data and zeroed .bss; SystemInit set VTOR/FPU.

Postcondition: The shelf scans on the panel; taps open books, browse, and read.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Precondition: Reset_Handler copied .data and zeroed .bss.; SystemInit set VTOR / FPU / priority grouping.

Postcondition: The slab/arena/tile/vmem banner is emitted; the CPU then loops in WFI.

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Precondition: Reset_Handler copied .data and zeroed .bss.; SystemInit set VTOR / FPU / priority grouping.

Postcondition: On success the cache globals are latched and g_pc_heartbeat advances.; On any failure g_pc_err is non-zero and the CPU parks (no heartbeat).

Since: 0.1.0

The application entry point Reset_Handler hands control to.

Profiles power modes once a second.

Precondition: Reset_Handler has copied .data and zeroed .bss.; SystemInit has set VTOR, FPU, and priority grouping.

Postcondition: On clean entry the CPU stays in the profile + blink loop.; On any HAL hard error LED2 latches ON.

Since: 0.1.0

Definition at line 287 of file main.c.

References k_kat_msg_fail, k_kat_msg_ok, k_kat_period_ms, k_ra8_board_led1, k_ra8_board_led2, kat_aes_gcm(), kat_ecdsa_p256(), kat_panic_halt(), kat_setup_or_halt(), kat_sha256(), ra8_board_led_toggle(), ra8_board_uart_console_write(), ra8_delay_ms(), and ra8_isr_globals_enable().

◆ unhex()

void unhex	(	const char *	hex,
		uint8_t *	out,
		size_t	n )

static

Decode 2*n hex chars into out (n bytes).

Definition at line 87 of file main.c.

References hex_nibble(), and k_hex_shift.

Referenced by kat_aes_gcm(), kat_ecdsa_p256(), and kat_sha256().

Variable Documentation

◆ k_kat_diag_boot

const uint8_t k_kat_diag_boot[] = "psa: boot (console up)\r\n"

static

Definition at line 65 of file main.c.

Referenced by kat_setup_or_halt().

◆ k_kat_diag_init_fail

const uint8_t k_kat_diag_init_fail[] = "psa: crypto_init FAIL\r\n"

static

Definition at line 66 of file main.c.

Referenced by kat_setup_or_halt().

◆ k_kat_diag_init_ok

const uint8_t k_kat_diag_init_ok[] = "psa: crypto_init ok\r\n"

static

Definition at line 67 of file main.c.

Referenced by kat_setup_or_halt().

◆ k_kat_msg_fail

const uint8_t k_kat_msg_fail[] = "psa crypto: KAT FAIL\r\n"

static

Definition at line 62 of file main.c.

Referenced by main().

◆ k_kat_msg_ok

const uint8_t k_kat_msg_ok[] = "psa crypto: KAT OK\r\n"

static

Definition at line 61 of file main.c.

Referenced by main().

◆ s_kat_heap

uint8_t s_kat_heap[k_kat_heap_bytes]

static

Static heap tf-psa's mbedtls_calloc draws from (no libc heap on target).

Definition at line 70 of file main.c.

Referenced by kat_setup_or_halt().

Enumerations

Functions

Variables

Detailed Description

Enumeration Type Documentation

◆ kat_const_t

◆ kat_size_t

Function Documentation

◆ gcm_dec_ok()

◆ gcm_enc_ok()

◆ hex_nibble()

◆ kat_aes_gcm()

◆ kat_ecdsa_p256()

◆ kat_panic_halt()

◆ kat_setup_or_halt()

◆ kat_sha256()

◆ main()

◆ unhex()

Variable Documentation

◆ k_kat_diag_boot

◆ k_kat_diag_init_fail

◆ k_kat_diag_init_ok

◆ k_kat_msg_fail

◆ k_kat_msg_ok

◆ s_kat_heap