ns_main.c File Reference

Non-Secure image: liveness beacon proving the BLXNS RoT gate passed (#172). More...

#include <stdint.h>

Include dependency graph for ns_main.c:

Go to the source code of this file.

Typedefs
typedef void(*	ns_exc_handler_t) (void)

Functions
static void	ns_nmi_halt (void)
	NMI / fault halt vector for the NS table.
static void	ns_reset_handler (void)
	NS-world reset handler – entered via BLXNS from the Secure side.

Variables
volatile uint32_t	g_sbns_ns_alive
	Liveness counter: advances forever once the NS reset handler runs.
uint32_t	g_ra8_ls_ns_stack_top
	Linker symbol: top of NS stack.
uint32_t	g_ra8_ls_ns_bss_start
	Linker symbol: start of .ns_bss.
uint32_t	g_ra8_ls_ns_bss_end
	Linker symbol: end of .ns_bss.
const ns_exc_handler_t	g_ra8_ns_vector_table [16]

Detailed Description

Non-Secure image: liveness beacon proving the BLXNS RoT gate passed (#172).

Tag

[Ring 6 / APP] {World: NS}

The Non-Secure half of the secure_boot_ns_hil two-project TrustZone build. The Secure side copies this image into the SRAM Non-secure alias (0x3210_0000), programmes the SAU, and – only if ra8_rot_verify_image authenticates the image's ECDSA-P256 signature – BLXNS-es to ns_reset_handler here.

This image is deliberately minimal: it makes NO NS->Secure calls (no CMSE import library, no veneers). After zeroing .ns_bss it advances a single liveness counter, g_sbns_ns_alive, forever. A J-Link memprobe that samples the counter twice and sees it ADVANCE proves the whole chain worked:

• the Secure RoT gate authenticated a genuine signed NS image,
• VTOR_NS was armed and BLXNS switched CPU0 to Non-Secure state,
• and the NS reset vector ran.

A TAMPERED NS image never reaches this code: the Secure gate default-denies, ra8_tz_secure_boot_jump_ns returns an error, and the counter stays 0.

Memory layout

Symbol	Section	Address (VMA)
g_ra8_ns_vector_table	.ns_vectors	0x32100000
.ns_rot_header	.ns_rot_header	0x32100040
ns_reset_handler	.ns_text	0x32100048+
g_sbns_ns_alive	.ns_bss	0x321000xx

(Run-time VMA in the SRAM NS alias; the image is flashed in Secure MRAM at the LMA 0x02080000 and copied here by the Secure trustzone_init.)

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Since

0.1.0

Definition in file ns_main.c.

Typedef Documentation

ns_exc_handler_t

typedef void(* ns_exc_handler_t) (void)

Definition at line 78 of file ns_main.c.

Function Documentation

ns_nmi_halt()

void ns_nmi_halt ( void )

static

NMI / fault halt vector for the NS table.

Any unmasked NS fault lands here and parks, so a J-Link halt plus a g_sbns_ns_alive read shows whether the NS code was making progress when the fault hit.

Returns

Never returns.

Precondition

Reached from an NS exception vector.

CPU is in NS thread or handler mode.

Postcondition

The core spins in WFI.

g_sbns_ns_alive stops advancing.

Note

Shared by every non-reset NS vector slot.

Since

0.1.0

Definition at line 95 of file ns_main.c.

ns_reset_handler()

void ns_reset_handler ( void )

static

NS-world reset handler – entered via BLXNS from the Secure side.

Zeros .ns_bss via uintptr_t arithmetic (cppcheck flags a pointer comparison between two distinct externs as ISO C UB even though the linker fixes them to a contiguous range), then advances g_sbns_ns_alive forever so a J-Link memprobe observes NS liveness.

Returns

Never returns.

Precondition

BLXNS from the Secure side landed here with MSP_NS = g_ra8_ls_ns_stack_top (the Secure RoT gate must have passed first).

The SAU exposes the NS SRAM alias to this code.

Postcondition

.ns_bss is zeroed.

g_sbns_ns_alive advances continually.

Note

Single-threaded; IRQs stay masked (no drivers, no RTOS).

Since

0.1.0

Definition at line 120 of file ns_main.c.

References g_ra8_ls_ns_bss_end, g_ra8_ls_ns_bss_start, and g_sbns_ns_alive.

Variable Documentation

g_ra8_ls_ns_bss_end

uint32_t g_ra8_ls_ns_bss_end

extern

Linker symbol: end of .ns_bss.

g_ra8_ls_ns_bss_start

uint32_t g_ra8_ls_ns_bss_start

extern

Linker symbol: start of .ns_bss.

g_ra8_ls_ns_stack_top

uint32_t g_ra8_ls_ns_stack_top

extern

Linker symbol: top of NS stack.

g_ra8_ns_vector_table

const ns_exc_handler_t g_ra8_ns_vector_table[16]

Initial value:

                                              = {
  (ns_exc_handler_t)&g_ra8_ls_ns_stack_top, 
  ns_reset_handler,                         
  ns_nmi_halt,                              
  ns_nmi_halt,                              
  ns_nmi_halt,                              
  ns_nmi_halt,                              
  ns_nmi_halt,                              
  ns_nmi_halt,                              
  0,                                        
  0,                                        
  0,                                        
  ns_nmi_halt,                              
  ns_nmi_halt,                              
  0,                                        
  ns_nmi_halt,                              
  ns_nmi_halt,                              
}

Definition at line 149 of file ns_main.c.

g_sbns_ns_alive

volatile uint32_t g_sbns_ns_alive

Liveness counter: advances forever once the NS reset handler runs.

Zeroed by ns_reset_handler on entry, then incremented in a tight loop. The HIL gate probes this symbol: a genuine signed NS image makes it advance; a tampered image is rejected before BLXNS so it stays 0. Lives in .ns_bss (SRAM NS alias 0x32100000+), squarely inside the SAU NS region.

Note

Read externally by J-Link only; firmware never reads it back.

Warning

Do not modify from outside the NS reset handler.

Since

0.1.0

Definition at line 63 of file ns_main.c.

Referenced by ns_reset_handler().