Copy-to-run launch: copy an image to the SRAM run base and branch to it. More...

#include "ra8_attributes.h"
#include "ra8_dfu.h"
#include "ra8_scb.h"

Include dependency graph for ra8_dfu_launch.c:

Functions
void	ra8_dfu_launch (uintptr_t src, uint32_t img_len, uint32_t entry)
	Copy an image to the SRAM run base and branch to it (copy-to-run).

Detailed Description

Copy-to-run launch: copy an image to the SRAM run base and branch to it.

Tag: [Ring 4 / Service] {World: S}

The shared copy-to-run hand-off behind the dfu_bootloader (which launches a validated slot body) and the dfu_copy_to_run HIL demo (which launches an embedded image). It copies img_len bytes from src to the fixed SRAM run base (k_ra8_dfu_run_base), then points the Secure VTOR there, loads the image's initial MSP, and branches to its reset vector – a same-world (Secure) branch (the reset vector keeps its Thumb bit). Because every payload is linked at the one run base, the same image runs wherever it was staged.

The destination is the trusted k_ra8_dfu_run_base constant, never a caller-supplied entry, so a corrupted entry cannot redirect the copy: it only fails the ra8_dfu_run_target_valid cross-check and the launch returns.

Authenticity is enforced BEFORE any copy: the signed image carries a ra8_rot_trailer_t after its body, and ra8_rot_verify_image must approve the SHA-256 + ECDSA-P256 signature against the provisioned root public key. The historical CRC32 (checked by the caller via ra8_dfu_hdr_valid) remains as an integrity pre-check, but the signature is the authority – on any signature / hash / trailer failure this function default-denies: it copies nothing, branches nowhere, and simply returns to the caller's fallback path.

The I/D caches are disabled on the EK-RA8D2 (libs/ra8_board_ek_ra8d2/src/boot/ system_init.c keeps them off), so the write-then-execute is made coherent by a DSB after the copy plus a DSB/ISB before the branch – no cache maintenance. If caches are ever enabled there, a clean-DCache + invalidate-ICache must be added before the branch.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file ra8_dfu_launch.c.

Function Documentation

◆ ra8_dfu_launch()

void ra8_dfu_launch	(	uintptr_t	src,
		uint32_t	img_len,
		uint32_t	entry )

Copy an image to the SRAM run base and branch to it (copy-to-run).

The shared copy-to-run hand-off (firmware only): validates entry / img_len with ra8_dfu_run_target_valid, copies img_len bytes from src to the trusted k_ra8_dfu_run_base, then sets the Secure VTOR to the run base, loads the image's initial MSP, and branches to its reset vector. Used by the dfu_bootloader (launching a slot body) and the dfu_copy_to_run HIL demo (launching an embedded image). The copy destination is always the run-base constant, never entry, so a corrupted entry cannot redirect it.

Interrupts are masked across the copy and switch; the launched image re-enables them after its own bring-up. Under RA8_OFF_TARGET the branch is elided (a host cannot reset MSP/VTOR), so the function validates and returns.

Parameters

[in]	src	Source image base (image body, vector table first); non-zero.
[in]	img_len	Image body length in bytes; a non-zero 32-byte multiple.
[in]	entry	The image's recorded run base; must equal k_ra8_dfu_run_base.

Returns: void – returns to the caller ONLY when the inputs fail validation (src == 0, or ra8_dfu_run_target_valid is false); on a valid image it does not return (control passes to the image).

Precondition: src points at a readable image whose first two words are MSP + reset.; The image was linked at k_ra8_dfu_run_base; the caller masks nothing special (this masks IRQs itself).

Postcondition: On a valid image, control is at the image's reset vector with VTOR / MSP pointing at the run base.; On invalid inputs, no copy or branch happens and control returns.

Note: Firmware only (inline MSP/VTOR/branch); not thread-safe.

See also: ra8_dfu_run_target_valid

Since: 0.1.0

Definition at line 97 of file ra8_dfu_launch.c.

References k_ra8_dfu_run_base, ra8_dfu_run_target_valid(), and ra8_scb_set_vtor().

Referenced by blc_boot_slot(), main(), and sb_tampered_rejected().

Functions

Detailed Description

Function Documentation

◆ ra8_dfu_launch()