main.c

Go to the documentation of this file.

 
#include <stddef.h>
#include <stdint.h>
 
#include "mbedtls/memory_buffer_alloc.h"
#include "ra8_board_ek_ra8d2.h"
#include "ra8_boot_entry.h"
#include "ra8_err.h"
#include "ra8_mstp.h"
#include "ra8_psa_crypto.h"
#include "ra8_tz_secure_boot.h"
#include "trustzone_init.h"

typedef enum : uint32_t {
  k_sbns_heap_bytes = 0x10000U, 
} sbns_const_t;

typedef enum : uint32_t {
  k_sbns_uart_baud = 115200U, 
} sbns_uart_t;

typedef enum : uint8_t {
  k_sbns_hex_nibbles    = 8U,  
  k_sbns_hex_bits       = 4U,  
  k_sbns_hex_dec_max    = 9U,  
  k_sbns_hex_alpha_base = 10U, 
} sbns_hex_t;

typedef enum : uint32_t {
  k_sbns_hex_nibble_mask = 0xFU, 
} sbns_hex_mask_t;

typedef enum : uint32_t {
  k_sbns_step_idle     = 0U, 
  k_sbns_step_crypto   = 1U, 
  k_sbns_step_armed    = 2U, 
  k_sbns_step_denied   = 3U, 
  k_sbns_step_psa_fail = 9U, 
} sbns_step_t;

volatile uint32_t g_sbns_step = k_sbns_step_idle;

volatile uint32_t g_sbns_denied;

volatile uint32_t g_sbns_jump_err;

static uint8_t s_sbns_heap[k_sbns_heap_bytes];

static bool s_sbns_console_up = false;

static const uint8_t k_sbns_msg_crypto_ready[] = "sbns: crypto ready\r\n";

static const uint8_t k_sbns_msg_verify_enter[] = "sbns: verify+enter NS\r\n";

static const uint8_t k_sbns_msg_reject[] = "sbns: NS REJECTED err=0x";

static const uint8_t k_sbns_msg_crlf[] = "\r\n";

[[noreturn]] static void sbns_park(void)
{
  while (1) {
    __asm__ volatile("wfi");
  }
}

static void sbns_console_bringup(void)
{
  if (ra8_mstp_init() != k_ra8_ok) {
    return;
  }
  if (ra8_board_uart_console_init((uint32_t)k_sbns_uart_baud) != k_ra8_ok) {
    return;
  }
  s_sbns_console_up = true;
}

static void sbns_console_say(const uint8_t* msg, uint32_t len)
{
  if (!s_sbns_console_up) {
    return;
  }
  if (msg == nullptr) {
    return;
  }
  (void)ra8_board_uart_console_write(msg, (size_t)len);
}

static void sbns_console_print_hex32(uint32_t value)
{
  if (!s_sbns_console_up) {
    return;
  }
  uint8_t buf[k_sbns_hex_nibbles];
  for (uint8_t i = 0U; i < (uint8_t)k_sbns_hex_nibbles; i++) {
    const uint32_t shift =
      (uint32_t)((uint8_t)k_sbns_hex_nibbles - 1U - i) * (uint32_t)k_sbns_hex_bits;
    const uint8_t nib = (uint8_t)((value >> shift) & (uint32_t)k_sbns_hex_nibble_mask);
    buf[i]            = (nib <= (uint8_t)k_sbns_hex_dec_max)
                          ? (uint8_t)('0' + nib)
                          : (uint8_t)('a' + (nib - (uint8_t)k_sbns_hex_alpha_base));
  }
  uint8_t first = 0U;
  while (first < (uint8_t)((uint8_t)k_sbns_hex_nibbles - 1U)) {
    if (buf[first] != (uint8_t)'0') {
      break;
    }
    first++;
  }
  (void)ra8_board_uart_console_write(&buf[first], (size_t)((uint8_t)k_sbns_hex_nibbles - first));
}

static void sbns_console_say_reject(ra8_err_t err)
{
  sbns_console_say(k_sbns_msg_reject, (uint32_t)(sizeof(k_sbns_msg_reject) - 1U));
  sbns_console_print_hex32((uint32_t)err);
  sbns_console_say(k_sbns_msg_crlf, (uint32_t)(sizeof(k_sbns_msg_crlf) - 1U));
}
 
void main(void)
{
  /* Bring up the crypto heap + PSA facade the root-of-trust verify needs. The
   * SAU + NS-image copy already ran in ra8_trustzone_init (SystemInit). */
  mbedtls_memory_buffer_alloc_init(s_sbns_heap, sizeof(s_sbns_heap));
  const ra8_err_t psa_err = ra8_psa_crypto_init();
  if ((psa_err != k_ra8_ok) && (psa_err != k_ra8_err_exists)) {
    g_sbns_step = k_sbns_step_psa_fail;
    sbns_park();
  }
  g_sbns_step = k_sbns_step_crypto;
 
  /* Bring up the Secure UART console and announce the crypto milestone so the
   * boot verdict is scrape-able on the bench. Best-effort: a dead console must
   * never gate the security decision, so the prints no-op if it failed. */
  sbns_console_bringup();
  sbns_console_say(k_sbns_msg_crypto_ready, (uint32_t)(sizeof(k_sbns_msg_crypto_ready) - 1U));
 
  /* Authenticate + jump. The RA8_ENABLE_ROOT_OF_TRUST gate inside jump_ns reads
   * the NS RoT header for the body length, verifies SHA-256 + ECDSA-P256, and
   * BLXNS-es ONLY on success. A genuine image never returns here. */
  g_sbns_step = k_sbns_step_armed;
  sbns_console_say(k_sbns_msg_verify_enter, (uint32_t)(sizeof(k_sbns_msg_verify_enter) - 1U));
  const ra8_err_t jump_err =
    ra8_tz_secure_boot_jump_ns((const uint32_t*)(uintptr_t)k_sbns_ns_run_base);
 
  /* Reached only when the gate DENIED the NS image (tampered / unsigned): the
   * default-deny path. Latch + print the outcome for the bench and halt -- the
   * NS world never ran, so g_sbns_ns_alive stays 0. */
  g_sbns_jump_err = (uint32_t)jump_err;
  g_sbns_denied   = 1U;
  g_sbns_step     = k_sbns_step_denied;
  sbns_console_say_reject(jump_err);
  sbns_park();
}