Cortex-M85 TrustZone-M Security Attribution Unit (SAU) bring-up. More...

#include "trustzone_init.h"
#include <stdint.h>
#include "ra8_boot_intrinsics.h"

Include dependency graph for trustzone_init.c:

Functions
void	ra8_trustzone_init (void)
	Programme + enable the SAU per the partition.

Detailed Description

Cortex-M85 TrustZone-M Security Attribution Unit (SAU) bring-up.

Tag: [Ring 1 / Boot] {World: S}

Note: RA8P1 board layer (issue #226): this chip-boot TU is byte-identical to the EK-RA8D2 copy. The RA8P1 (R7KA8P1KFLCAC) shares the RA8D2 Cortex-M85 SAU and the IDAU bit-28 security split (see libs/ra8_core/inc/ra8_device.h), so the SAU bring-up is common to both boards.

scaffold for the secure / non-secure address-space split. Programs the SAU with four canonical regions and enables it. Called from SystemInit after the cache + MPU are up but before any non-secure code can run.

The function is gated behind the RA8_TRUSTZONE_ENABLE build symbol so the single-world build (the ..8 default) does not pay any code-size cost. When the symbol is undefined, ra8_trustzone_init is an empty inline.

Partition layout (scaffold)

The RA8D2 IDAU defines bit 28 of the address as the security attribute by default (S = bit 28 clear, NS = bit 28 set). The SAU overlays additional rules. The partition is:

Region	Range	Attribute
0	0x02080000..0x020FFFFF	NS (upper MRAM)
1	0x22100000..0x221FFFFF	NS (upper SRAM)
2	0x6A000000..0x6BFFFFFF	NS (upper SDRAM)
3	0x10000000..0x100FFFFF	NSC veneer alias

Lower MRAM (0x02000000..0x0207FFFF) stays secure – holds the secure world image.
Lower SRAM (0x22000000..0x220FFFFF) stays secure – holds the secure-world data + key vault.
Upper MRAM / SRAM / SDRAM are exposed to the NS world for the application.
The NSC veneer page lives in a 1 MB alias the linker maps via the .gnu.sgstubs section.

These addresses are illustrative – the actual partition lands once the linker script grows the matching memory regions and the veneer section is wired up.

TrustZone Safety:

Validates: SAU_TYPE.SREGION reports >= 4 regions before programming any of them (chip family safety check).
Trusts: the Boot ROM left the SAU disabled and the IDAU in its reset state.
Denies: any access from NS code to the registers programmed here – the entire SAU register window lives in the secure region by definition.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file trustzone_init.c.

Function Documentation

◆ ra8_trustzone_init()

void ra8_trustzone_init ( void )

Programme + enable the SAU per the partition.

No-op TrustZone init for the secure-only USB experiment.

Programme the SAU + SRAM NS boundary and copy the NS image (no BLXNS).

Called from SystemInit after the cache + MPU are up but before any application code runs. When the firmware is built without RA8_TRUSTZONE_ENABLE defined this function is a no-op so the single-world build is unaffected.

Precondition: Called once from SystemInit.; Called from secure world only (the SAU registers live at 0xE000EDD0 which is not reachable from NS).

Postcondition: On success, SAU_CTRL.ENABLE is set and the four canonical regions cover NS MRAM / SRAM / SDRAM + the NSC veneer alias.; On an unusable SAU (< 4 regions) SAU_CTRL.ENABLE stays clear and the caller falls back to the single-world model.

TrustZone Safety:

Validates: SAU_TYPE.SREGION >= 4 before programming.
Trusts: boot ROM left SAU disabled and IDAU at reset state.
Denies: any access to the SAU registers from NS world.

Note: Thread safety: not thread-safe; runs once at boot.

Since: 0.1.0

Definition at line 166 of file trustzone_init.c.

References internal_sau_set_region(), ra8_boot_dsb(), ra8_boot_isb(), ra8_boot_read32(), and ra8_boot_write32().

Functions

Detailed Description

Partition layout (scaffold)

Function Documentation

◆ ra8_trustzone_init()