security.h File Reference

Local security-state and explicit SAU region mechanisms. More...

#include "nexus/arch/features.h"

Go to the source code of this file.

Data Structures
struct	nx_arch_sau_region_t
	Exact 32-byte-aligned SAU region owned by the Secure caller. More...
struct	nx_arch_sau_words_t
	Validated SAU words; encoding never changes hardware. More...

Functions
nx_arch_security_state_t	nx_arch_security_state (void)
	Query this image's compiled security state.
nx_arch_result_t	nx_arch_sau_encode (const nx_arch_sau_region_t *region, nx_arch_sau_words_t *words)
	Encode an explicit SAU region without hardware access.
nx_arch_result_t	nx_arch_sau_write (uint32_t index, const nx_arch_sau_region_t *region)
	Program one owned SAU region while the SAU is disabled.
nx_arch_result_t	nx_arch_sau_clear (uint32_t index)
	Disable one owned SAU region while the SAU is disabled.

Detailed Description

Local security-state and explicit SAU region mechanisms.

Author

Nexus Team

Definition in file security.h.

Function Documentation

nx_arch_sau_clear()

nx_arch_result_t nx_arch_sau_clear

(

uint32_t

index

)

Disable one owned SAU region while the SAU is disabled.

Parameters

[in]

index

Region index below the actual hardware TYPE count.

Returns

OK, INVALID, CONTEXT or UNSUPPORTED without other writes.

Note

Same context and ownership contract as nx_arch_sau_write. Preserves CTRL, ALLNS, other regions and incoming RNR.

nx_arch_sau_encode()

nx_arch_result_t nx_arch_sau_encode	(	const nx_arch_sau_region_t *	region,
		nx_arch_sau_words_t *	words )

Encode an explicit SAU region without hardware access.

Parameters

[in]	region	Base aligned to 32 bytes; inclusive limit ending at a complete 32-byte boundary. Base must not exceed limit.
[out]	words	Encoded region, unchanged on failure.

Returns

OK or INVALID for null arguments or invalid boundaries.

Note

Pure Task/IRQ operation. Encoding marks the requested region enabled but does not enable SAU hardware. External policy owns overlap, IDAU restrictions and NSC veneers.

nx_arch_sau_write()

nx_arch_result_t nx_arch_sau_write	(	uint32_t	index,
		const nx_arch_sau_region_t *	region )

Program one owned SAU region while the SAU is disabled.

Parameters

[in]	index	Region index below the actual hardware TYPE count.
[in]	region	Explicit reviewed region and NSC permission.

Returns

OK, INVALID, CONTEXT or UNSUPPORTED without retained state.

Note

Secure privileged Thread with incoming PRIMASK set only. Caller excludes all other region/selector users and keeps NMI/HardFault outside this metadata. Requires reviewed SAU region support. Does not modify CTRL, ALLNS, another region, another security world's registers or enable the SAU. Current RNR is restored; DSB/ISB complete region writes. Policy, secure gateways and IDAU configuration stay external.

nx_arch_security_state()

nx_arch_security_state_t nx_arch_security_state

(

void

)

Query this image's compiled security state.

Returns

Single-domain, Secure or NonSecure reviewed image state.

Note

Bounded read-only Task/IRQ query, no hardware access. This does not grant access to another world's memory or devices.