ra8_nsc_wdt.c File Reference

NSC veneers: secure-side watchdog arm + refresh. More...

#include "ra8_err.h"
#include "ra8_nsc.h"
#include "ra8_nsc_veneer.h"
#include "ra8_wdt.h"

Include dependency graph for ra8_nsc_wdt.c:

Go to the source code of this file.

Functions
ra8_err_t	ra8_nsc_wdt_start (void)
	NSC veneer: arm the Secure WDT with the e-reader configuration.
void	ra8_nsc_wdt_refresh (void)
	NSC veneer: refresh the Secure WDT down-counter.

Variables
static const ra8_wdt_cfg_t	s_wdt_cfg
	Fixed Secure-side WDT configuration used by ra8_nsc_wdt_start.

Detailed Description

NSC veneers: secure-side watchdog arm + refresh.

Tag

[Ring 4 / NSC] {World: NSC}

The WDT (ra8_wdt, HUM Ch 27) is a Secure-owned peripheral – only the Secure world programmes WDTCR / WDTRR. The Non-Secure e-reader runs the ThreadX watchdog supervisor (ra8_wdt_supervisor), which decides in NS whether every worker thread is alive and, when so, must refresh the WDT down-counter. NS cannot touch WDTRR directly, so these two argument-free veneers give it a Secure gateway:

• ra8_nsc_wdt_start – arm the counter once, with a fixed Secure-side configuration, just before the supervisor thread begins refreshing it.
• ra8_nsc_wdt_refresh – refresh the down-counter on the supervisor's cadence. It returns void so it installs directly as the supervisor's ra8_wdt_sup_refresh_fn_t hook.

Neither veneer takes a pointer argument, so no cmse_check_address_range is required: nothing crosses the boundary that must be range-checked.

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file ra8_nsc_wdt.c.

Function Documentation

ra8_nsc_wdt_refresh()

void ra8_nsc_wdt_refresh

(

void

)

NSC veneer: refresh the Secure WDT down-counter.

Forwards to ra8_wdt_refresh_deferred (WDTRR heartbeat). Installed as the ThreadX supervisor's ra8_wdt_sup_refresh_fn_t hook so the supervisor kicks the WDT only when every registered NS thread has checked in on time.

Returns

Nothing.

Note

This function does not return a value.

Precondition

ra8_nsc_wdt_start has armed the WDT.

Called from the NS supervisor thread on its refresh cadence.

Postcondition

The WDT down-counter has been reloaded (refresh issued).

No NS-visible state is modified.

Note

Thread safety: the supervisor calls this from one thread only.

Since

0.1.0

Definition at line 106 of file ra8_nsc_wdt.c.

References RA8_NSC_VENEER, and ra8_wdt_refresh_deferred().

Referenced by internal_wdt_setup().

ra8_nsc_wdt_start()

ra8_err_t ra8_nsc_wdt_start ( void )

nodiscard

NSC veneer: arm the Secure WDT with the e-reader configuration.

Forwards to ra8_wdt_init with the fixed s_wdt_cfg. In register-start mode ra8_wdt_init programmes WDTCR/WDTRCR/WDTCSTPR and issues the unlock sequence that arms the down-counter, so the NS caller should invoke this immediately before starting the supervisor thread that refreshes it – keeping the arm-to-first-refresh gap small (as the flat demo does).

Returns

ra8_err_t outcome from ra8_wdt_init.

Return values

k_ra8_ok	WDT configured and armed.
k_ra8_err_invalid_arg	The fixed configuration was rejected by the driver.

Precondition

The Secure substrate is initialized (clocks running).

No prior code has armed the WDT (single arm per boot).

Postcondition

The WDT down-counter is running and expects a refresh within the timeout.

WDTCR reflects s_wdt_cfg.

Note

Thread safety: call once, from the NS boot thread, before the supervisor starts. Not re-entrant.

Since

0.1.0

Definition at line 82 of file ra8_nsc_wdt.c.

References RA8_NSC_VENEER, ra8_wdt_init(), and s_wdt_cfg.

Referenced by internal_wdt_setup().

Variable Documentation

s_wdt_cfg

const ra8_wdt_cfg_t s_wdt_cfg

static

Initial value:

                                     = {
  .timeout       = k_ra8_wdt_timeout_1024,
  .clock_div     = k_ra8_wdt_clkdiv_4,
  .window_start  = k_ra8_wdt_window_start_100,
  .window_end    = k_ra8_wdt_window_end_0,
  .on_expiry     = k_ra8_wdt_on_expiry_nmi,
  .stop_in_sleep = k_ra8_wdt_sleep_stop_count,
}

Fixed Secure-side WDT configuration used by ra8_nsc_wdt_start.

Mirrors the validated wdt_supervisor_demo configuration: a fully-open refresh window (window_start_100 / window_end_0 – no upper or lower bound, so any refresh before the timeout is accepted), the counter halted in Sleep, and expiry routed to NMI rather than an internal reset (switching to k_ra8_wdt_on_expiry_reset is a separate product decision). Living in the Secure .rodata it is never reachable from NS.

Note

Access restriction: Secure world only; the veneers copy nothing from NS.

Warning

Do not point NS code at this object; it is a Secure-side constant.

Since

0.1.0

Definition at line 50 of file ra8_nsc_wdt.c.

Referenced by ra8_nsc_wdt_start().