trustzone_init.c File Reference

Single-core TrustZone bring-up for a RAM-resident NS image (#172). More...

#include "trustzone_init.h"
#include <stdint.h>
#include "ra8_err.h"

Include dependency graph for trustzone_init.c:

Go to the source code of this file.

Functions
void	ra8_trustzone_init (void)
	Programme + enable the SAU per the partition.

Detailed Description

Single-core TrustZone bring-up for a RAM-resident NS image (#172).

Tag

[Ring 1 / Boot] {World: S}

The RA8 IDAU is FIXED by address bit[28] (HUM section 51.3.3.1, p3265): bit[28]=0 is Secure/NSC and the SAU cannot downgrade it, so an "NS" image at the 0x02.. / 0x22.. (bit[28]=0) aliases always executes Secure. Real NS lives at the bit[28]=1 aliases (0x12.. code, 0x32.. SRAM, 0x5.. peripherals).

Code MRAM's secure/NS split needs persistent (brick-risky) option bytes, but SRAM's split is the RUNTIME SRAMSABARn register, so the NS image is RAM-resident: flashed into Secure MRAM (the LMA) and copied by this code into the SRAM Non-secure alias 0x3210_0000 (physical SRAM2) after SRAMSABAR2 marks SRAM2 Non-secure. No option bytes, no brick.

Boot sequence (this file, all in Secure state, called from SystemInit):

1. Open PRCR_S.PRC4 and program SRAMSABAR0..3 so physical SRAM [0x10_0000, 0x18_0000) (SRAM2) is Non-secure; lower SRAM (the Secure stack + heap) stays Secure. Re-lock PRC4.
2. Programme the SAU to the bit[28] model (HUM p3267): mark the IDAU-NS ranges 0x1000_0000-, 0x3000_0000-, 0x5000_0000- as NS. Enable the SAU with ALLNS = 0 (default-deny). No NSC region: this NS image makes no NS->Secure calls (no veneers).
3. Copy the NS image from its MRAM LMA to the SRAM NS alias.

It deliberately does NOT BLXNS: main() runs the root-of-trust verify (which needs the crypto heap the C runtime sets up) and then jumps. On a host build (RA8_OFF_TARGET or no RA8_TRUSTZONE_ENABLE) this is a no-op.

TrustZone Safety:

• Validates: SAU_TYPE.SREGION >= 3 before programming.
• Trusts: the boot ROM left the SAU disabled and the IDAU in its documented reset state (fixed bit[28] split).
• Denies: main() denies the BLXNS on a failed root-of-trust verify.

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file trustzone_init.c.

Function Documentation

ra8_trustzone_init()

void ra8_trustzone_init

(

void

)

Programme + enable the SAU per the partition.

No-op TrustZone init for the secure-only USB experiment.

Programme the SAU + SRAM NS boundary and copy the NS image (no BLXNS).

Called from SystemInit after the cache + MPU are up but before any application code runs. When the firmware is built without RA8_TRUSTZONE_ENABLE defined this function is a no-op so the single-world build is unaffected.

Precondition

Called once from SystemInit.

Called from secure world only (the SAU registers live at 0xE000EDD0 which is not reachable from NS).

Postcondition

On success, SAU_CTRL.ENABLE is set and the four canonical regions cover NS MRAM / SRAM / SDRAM + the NSC veneer alias.

On an unusable SAU (< 4 regions) SAU_CTRL.ENABLE stays clear and the caller falls back to the single-world model.

TrustZone Safety:

• Validates: SAU_TYPE.SREGION >= 4 before programming.
• Trusts: boot ROM left SAU disabled and IDAU at reset state.
• Denies: any access to the SAU registers from NS world.

Note

Thread safety: not thread-safe; runs once at boot.

Since

0.1.0

Definition at line 302 of file trustzone_init.c.

References k_ra8_ok.