trustzone_init.h File Reference

Cortex-M85 TrustZone-M SAU bring-up entry point. More...

#include <stdint.h>

Include dependency graph for trustzone_init.h:

Go to the source code of this file.

Functions
void	ra8_trustzone_init (void)
	Programme + enable the SAU per the partition.

Variables
J-Link bench-probe verdict globals
The TrustZone bring-up TU that defines ra8_trustzone_init() latches its per-step verdicts into these volatile globals so a debugger can read them across a halt without any console. They are a bench-probe interface, NOT an API: firmware code other than the defining TU must never read or write them. Each defining TU provides the subset it latches; the others stay undefined and unreferenced in that image. Note Written once during boot by the defining TU; read externally by J-Link only. Since 0.1.0
volatile uint32_t	g_tz_usb_psarb_readback
	Confirmed PSARB read-back after the USBFS NS-attribution write.
volatile uint32_t	g_tz_usb_pins_err
	First non-OK ra8_err_t from the USB pin + PLL setup (0 = OK).
volatile uint32_t	g_tz_usb_expander_err
	Last ra8_err_t from the U15 I/O-expander host-mode write (0 = OK).
volatile uint32_t	g_tz_jump_ns_err
	Denial verdict from ra8_tz_secure_boot_jump_ns (0 = never denied).

Detailed Description

Cortex-M85 TrustZone-M SAU bring-up entry point.

Declares the board composition hook that programs the validated RA8P1 secure attribution map before non-secure execution begins.

Tag

[Ring 1 / Boot] {World: S}

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file trustzone_init.h.

Function Documentation

ra8_trustzone_init()

void ra8_trustzone_init

(

void

)

Programme + enable the SAU per the partition.

Called from SystemInit after the cache + MPU are up but before any application code runs. When the firmware is built without RA8_TRUSTZONE_ENABLE defined this function is a no-op so the single-world build is unaffected.

Precondition

Called once from SystemInit.

Called from secure world only (the SAU registers live at 0xE000EDD0 which is not reachable from NS).

Postcondition

On success, SAU_CTRL.ENABLE is set and the four canonical regions cover NS MRAM / SRAM / SDRAM + the NSC veneer alias.

On an unusable SAU (< 4 regions) SAU_CTRL.ENABLE stays clear and the caller falls back to the single-world model.

TrustZone Safety:

• Validates: SAU_TYPE.SREGION >= 4 before programming.
• Trusts: boot ROM left SAU disabled and IDAU at reset state.
• Denies: any access to the SAU registers from NS world.

Note

Thread safety: not thread-safe; runs once at boot.

Since

0.1.0

Definition at line 161 of file trustzone_init.c.

Variable Documentation

g_tz_jump_ns_err

volatile uint32_t g_tz_jump_ns_err

extern

Denial verdict from ra8_tz_secure_boot_jump_ns (0 = never denied).

g_tz_usb_expander_err

volatile uint32_t g_tz_usb_expander_err

extern

Last ra8_err_t from the U15 I/O-expander host-mode write (0 = OK).

g_tz_usb_pins_err

volatile uint32_t g_tz_usb_pins_err

extern

First non-OK ra8_err_t from the USB pin + PLL setup (0 = OK).

g_tz_usb_psarb_readback

volatile uint32_t g_tz_usb_psarb_readback

extern

Confirmed PSARB read-back after the USBFS NS-attribution write.