trustzone_init.h File Reference

Secure TrustZone bring-up contract for the BLXNS RoT proof (#172). More...

#include <stdint.h>

Include dependency graph for trustzone_init.h:

Go to the source code of this file.

Enumerations
enum	sbns_ns_image_t : uintptr_t {   k_sbns_ns_load_base = 0x02080000U ,   k_sbns_ns_run_base = 0x32100000U ,   k_sbns_ns_copy_size = 0x00010000U }
	Fixed Non-Secure image load / run / copy-window addresses. More...

Functions
void	ra8_trustzone_init (void)
	Programme the SAU + SRAM NS boundary and copy the NS image (no BLXNS).

Detailed Description

Secure TrustZone bring-up contract for the BLXNS RoT proof (#172).

Tag

[Ring 1 / Boot] {World: S}

Declares ra8_trustzone_init (called from SystemInit before the C runtime is live) and the fixed Non-Secure image addresses shared between trustzone_init.c (which copies the NS image MRAM->SRAM) and main.c (which authenticates it and BLXNS-es to it). The values MUST match ns_image.ld's NS_LOAD / NS_SRAM_RUN origins.

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file trustzone_init.h.

Enumeration Type Documentation

sbns_ns_image_t

enum sbns_ns_image_t : uintptr_t

Fixed Non-Secure image load / run / copy-window addresses.

The NS image is a SEPARATE ELF, so the Secure side has none of its linker symbols and must hard-code these (they mirror ns_image.ld). It is flashed at the MRAM LMA and copied to the SRAM2 Non-secure alias before BLXNS.

Invariant

Matches ORIGIN(NS_LOAD) / ORIGIN(NS_SRAM_RUN) in ns_image.ld.

Enumerator
k_sbns_ns_load_base	NS image LMA (Secure MRAM).
k_sbns_ns_run_base	NS image VMA (SRAM2 NS alias).
k_sbns_ns_copy_size	Bytes copied LMA->VMA (64 KiB).

Definition at line 38 of file trustzone_init.h.

Function Documentation

ra8_trustzone_init()

void ra8_trustzone_init

(

void

)

Programme the SAU + SRAM NS boundary and copy the NS image (no BLXNS).

Carves the SRAM2 Non-secure aperture via SRAMSABARn, programmes the bit[28] SAU (the IDAU-NS ranges Non-secure, ALLNS = 0 default-deny), and copies the NS image from its MRAM LMA to the SRAM run base. It deliberately does NOT jump: main() performs the root-of-trust verify + BLXNS after the C runtime (and the crypto heap) is live. On a host build (RA8_OFF_TARGET or no RA8_TRUSTZONE_ENABLE) it is a no-op.

Returns

void.

Precondition

Caller is in Secure state, single-threaded, early boot (from SystemInit).

The SAU is disabled and the IDAU is in its documented reset state.

Postcondition

SRAM2 is Non-secure, the SAU is enabled, and the NS image is resident at k_sbns_ns_run_base (or nothing happened on a host build).

No BLXNS is performed; control returns to the caller.

Note

Not thread-safe; runs once at boot.

Since

0.1.0

Programme the SAU + SRAM NS boundary and copy the NS image (no BLXNS).

Called from SystemInit after the cache + MPU are up but before any application code runs. When the firmware is built without RA8_TRUSTZONE_ENABLE defined this function is a no-op so the single-world build is unaffected.

Precondition

Called once from SystemInit.

Called from secure world only (the SAU registers live at 0xE000EDD0 which is not reachable from NS).

Postcondition

On success, SAU_CTRL.ENABLE is set and the four canonical regions cover NS MRAM / SRAM / SDRAM + the NSC veneer alias.

On an unusable SAU (< 4 regions) SAU_CTRL.ENABLE stays clear and the caller falls back to the single-world model.

TrustZone Safety:

• Validates: SAU_TYPE.SREGION >= 4 before programming.
• Trusts: boot ROM left SAU disabled and IDAU at reset state.
• Denies: any access to the SAU registers from NS world.

Note

Thread safety: not thread-safe; runs once at boot.

Since

0.1.0

Definition at line 161 of file trustzone_init.c.