zephyrproject-rtos · avolmat-st · Dec 2, 2025 · Dec 2, 2025
diff --git a/drivers/display/Kconfig.stm32_ltdc b/drivers/display/Kconfig.stm32_ltdc
@@ -8,7 +8,6 @@ menuconfig STM32_LTDC
 	default y
 	depends on DT_HAS_ST_STM32_LTDC_ENABLED
 	select USE_STM32_HAL_LTDC
-	select USE_STM32_HAL_RIF if SOC_SERIES_STM32N6X
 	select CACHE_MANAGEMENT if CPU_HAS_DCACHE
 	select PINCTRL
 	select RESET

diff --git a/drivers/display/display_stm32_ltdc.c b/drivers/display/display_stm32_ltdc.c
@@ -357,9 +357,6 @@ static int stm32_ltdc_init(const struct device *dev)
 	int err;
 	const struct display_stm32_ltdc_config *config = dev->config;
 	struct display_stm32_ltdc_data *data = dev->data;
-#if defined(CONFIG_SOC_SERIES_STM32N6X)
-	RIMC_MasterConfig_t rimc = {0};
-#endif
 
 	/* Configure and set display on/off GPIO */
 	if (config->disp_on_gpio.port) {
@@ -459,15 +456,6 @@ static int stm32_ltdc_init(const struct device *dev)
 		return err;
 	}
 
-#if defined(CONFIG_SOC_SERIES_STM32N6X)
-	/* Configure RIF for LTDC layer 1 */
-	rimc.MasterCID = RIF_CID_1;
-	rimc.SecPriv = RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV;
-	HAL_RIF_RIMC_ConfigMasterAttributes(RIF_MASTER_INDEX_LTDC1, &rimc);
-	HAL_RIF_RISC_SetSlaveSecureAttributes(RIF_RISC_PERIPH_INDEX_LTDCL1,
-					      RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV);
-#endif
-
 	/* Disable layer 2, since it not used */
 	__HAL_LTDC_LAYER_DISABLE(&data->hltdc, LTDC_LAYER_2);
 

diff --git a/drivers/ethernet/Kconfig.stm32_hal b/drivers/ethernet/Kconfig.stm32_hal
@@ -9,7 +9,6 @@ menuconfig ETH_STM32_HAL
 	default y
 	depends on DT_HAS_ST_STM32_ETHERNET_ENABLED
 	select USE_STM32_HAL_ETH
-	select USE_STM32_HAL_RIF if SOC_SERIES_STM32N6X
 	select NOCACHE_MEMORY if (SOC_SERIES_STM32H7X && CPU_CORTEX_M7) || SOC_SERIES_STM32N6X
 	select HWINFO
 	select ETH_DSA_SUPPORT_DEPRECATED

diff --git a/drivers/ethernet/eth_stm32_hal_common.c b/drivers/ethernet/eth_stm32_hal_common.c
@@ -140,32 +140,6 @@ static void generate_mac(uint8_t *mac_addr)
 #endif
 }
 
-#if DT_HAS_COMPAT_STATUS_OKAY(st_stm32n6_ethernet)
-/**
- * Configures the RISAF (RIF Security Attribute Framework) for Ethernet on STM32N6.
- * This function sets up the master and slave security attributes for the Ethernet peripheral.
- */
-
-static void RISAF_Config(void)
-{
-	/* Define and initialize the master configuration structure */
-	RIMC_MasterConfig_t RIMC_master = {0};
-
-	/* Enable the clock for the RIFSC (RIF Security Controller) */
-	__HAL_RCC_RIFSC_CLK_ENABLE();
-
-	RIMC_master.MasterCID = RIF_CID_1;
-	RIMC_master.SecPriv = RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV;
-
-	/* Configure the master attributes for the Ethernet peripheral (ETH1) */
-	HAL_RIF_RIMC_ConfigMasterAttributes(RIF_MASTER_INDEX_ETH1, &RIMC_master);
-
-	/* Set the secure and privileged attributes for the Ethernet peripheral (ETH1) as a slave */
-	HAL_RIF_RISC_SetSlaveSecureAttributes(RIF_RISC_PERIPH_INDEX_ETH1,
-					      RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV);
-}
-#endif
-
 static int eth_initialize(const struct device *dev)
 {
 	struct eth_stm32_hal_dev_data *dev_data = dev->data;
@@ -178,11 +152,6 @@ static int eth_initialize(const struct device *dev)
 		return -ENODEV;
 	}
 
-#if DT_HAS_COMPAT_STATUS_OKAY(st_stm32n6_ethernet)
-	/* RISAF Configuration */
-	RISAF_Config();
-#endif
-
 	/* enable clock */
 	ret = clock_control_on(DEVICE_DT_GET(STM32_CLOCK_CONTROL_NODE),
 		(clock_control_subsys_t)&cfg->pclken);

diff --git a/drivers/video/Kconfig.stm32_dcmipp b/drivers/video/Kconfig.stm32_dcmipp
@@ -8,7 +8,6 @@ config VIDEO_STM32_DCMIPP
 	default y
 	depends on DT_HAS_ST_STM32_DCMIPP_ENABLED
 	select USE_STM32_HAL_DCMIPP
-	select USE_STM32_HAL_RIF if SOC_SERIES_STM32N6X
 	select RESET
 	select PINCTRL
 	help

diff --git a/drivers/video/Kconfig.stm32_jpeg b/drivers/video/Kconfig.stm32_jpeg
@@ -12,6 +12,5 @@ config VIDEO_STM32_JPEG
 	select USE_STM32_HAL_JPEG
 	select USE_STM32_HAL_DMA
 	select USE_STM32_HAL_DMA_EX
-	select USE_STM32_HAL_RIF if SOC_SERIES_STM32N6X
 	help
 	  Enable driver for STM32 JPEG HW Codec peripheral
diff --git a/drivers/video/Kconfig.stm32_venc b/drivers/video/Kconfig.stm32_venc
@@ -10,7 +10,6 @@ config VIDEO_STM32_VENC
 	depends on VIDEO_ENCODER_H264
 	select HAS_STM32LIB
 	select USE_STM32_LL_VENC
-	select USE_STM32_HAL_RIF if SOC_SERIES_STM32N6X
 	select RESET
 	help
 	  Enable driver for STM32 video encoder peripheral.

diff --git a/drivers/video/video_stm32_dcmipp.c b/drivers/video/video_stm32_dcmipp.c
@@ -1694,10 +1694,6 @@ static int stm32_dcmipp_init(const struct device *dev)
 
 	int err;
 
-#if defined(CONFIG_SOC_SERIES_STM32N6X)
-	RIMC_MasterConfig_t rimc = {0};
-#endif
-
 	dcmipp->enabled_pipe = 0;
 
 #if defined(STM32_DCMIPP_HAS_PIXEL_PIPES)
@@ -1736,14 +1732,6 @@ static int stm32_dcmipp_init(const struct device *dev)
 	/* Run IRQ init */
 	cfg->irq_config(dev);
 
-#if defined(CONFIG_SOC_SERIES_STM32N6X)
-	rimc.MasterCID = RIF_CID_1;
-	rimc.SecPriv = RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV;
-	HAL_RIF_RIMC_ConfigMasterAttributes(RIF_MASTER_INDEX_DCMIPP, &rimc);
-	HAL_RIF_RISC_SetSlaveSecureAttributes(RIF_RISC_PERIPH_INDEX_DCMIPP,
-					      RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV);
-#endif
-
 	/* Initialize DCMI peripheral */
 	err = HAL_DCMIPP_Init(&dcmipp->hdcmipp);
 	if (err != HAL_OK) {

diff --git a/drivers/video/video_stm32_jpeg.c b/drivers/video/video_stm32_jpeg.c
@@ -521,11 +521,6 @@ static int stm32_jpeg_init(const struct device *dev)
 	/* Run IRQ init */
 	cfg->irq_config(dev);
 
-#if defined(CONFIG_SOC_SERIES_STM32N6X)
-	HAL_RIF_RISC_SetSlaveSecureAttributes(RIF_RISC_PERIPH_INDEX_JPEG,
-					      RIF_ATTRIBUTE_PRIV | RIF_ATTRIBUTE_SEC);
-#endif
-
 	/* Initialise default input / output formats */
 	k_mutex_init(&data->lock);
 	k_fifo_init(&data->m2m.in.fifo_in);

diff --git a/drivers/video/video_stm32_venc.c b/drivers/video/video_stm32_venc.c
@@ -841,25 +841,6 @@ static const struct stm32_venc_config stm32_venc_config_0 = {
 	.irq_config = stm32_venc_irq_config_func,
 };
 
-static void risaf_config(void)
-{
-	/* Define and initialize the master configuration structure */
-	RIMC_MasterConfig_t rimc_master = {0};
-
-	/* Enable the clock for the RIFSC (RIF Security Controller) */
-	__HAL_RCC_RIFSC_CLK_ENABLE();
-
-	rimc_master.MasterCID = RIF_CID_1;
-	rimc_master.SecPriv = RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV;
-
-	/* Configure the master attributes for the video encoder peripheral (VENC) */
-	HAL_RIF_RIMC_ConfigMasterAttributes(RIF_MASTER_INDEX_VENC, &rimc_master);
-
-	/* Set the secure and privileged attributes for the VENC as a slave */
-	HAL_RIF_RISC_SetSlaveSecureAttributes(RIF_RISC_PERIPH_INDEX_VENC,
-					      RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV);
-}
-
 static int stm32_venc_init(const struct device *dev)
 {
 	const struct stm32_venc_config *config = dev->config;
@@ -890,8 +871,6 @@ static int stm32_venc_init(const struct device *dev)
 	/* Run IRQ init */
 	config->irq_config(dev);
 
-	risaf_config();
-
 	LOG_DBG("CPU frequency    : %d", HAL_RCC_GetCpuClockFreq() / 1000000);
 	LOG_DBG("sysclk frequency : %d", HAL_RCC_GetSysClockFreq() / 1000000);
 	LOG_DBG("pclk5 frequency  : %d", HAL_RCC_GetPCLK5Freq() / 1000000);

diff --git a/soc/st/stm32/stm32n6x/Kconfig b/soc/st/stm32/stm32n6x/Kconfig
@@ -23,6 +23,7 @@ config SOC_SERIES_STM32N6X
 	# MPU_GAP_FILLING is default when !USERSPACE, select it in the other case as well.
 	select MPU_GAP_FILLING if USERSPACE
 	select CPU_HAS_CUSTOM_FIXED_SOC_MPU_REGIONS if USERSPACE && !XIP
+	select USE_STM32_HAL_RIF if STM32N6_RIF_OPEN
 
 if SOC_SERIES_STM32N6X
 
@@ -31,9 +32,17 @@ config STM32N6_BOOT_SERIAL
 
 config STM32N6_NPU
 	bool "Neural-ART accelerator (NPU)"
-	select USE_STM32_HAL_RIF
 	select RESET
 	default y
 	depends on DT_HAS_ST_STM32_NPU_ENABLED
 
+config STM32N6_RIF_OPEN
+	bool "Configure the RIF with all OPEN access"
+	default y
+	depends on TRUSTED_EXECUTION_SECURE
+	help
+	  When this option is enabled, the RIMC of all masters and the RISC of all slaves are
+	  configured during SoC initialization. Zephyr running with Secure privileges has full
+	  access to all SoC resources.
+
 endif # SOC_SERIES_STM32N6X
diff --git a/soc/st/stm32/stm32n6x/npu/npu_stm32n6.c b/soc/st/stm32/stm32n6x/npu/npu_stm32n6.c
@@ -25,17 +25,6 @@ struct npu_stm32_cfg {
 	const struct reset_dt_spec reset_cacheaxi;
 };
 
-static void npu_risaf_config(void)
-{
-	RIMC_MasterConfig_t RIMC_master = {0};
-
-	RIMC_master.MasterCID = RIF_CID_1;
-	RIMC_master.SecPriv = RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV;
-	HAL_RIF_RIMC_ConfigMasterAttributes(RIF_MASTER_INDEX_NPU, &RIMC_master);
-	HAL_RIF_RISC_SetSlaveSecureAttributes(RIF_RISC_PERIPH_INDEX_NPU,
-					      RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV);
-}
-
 static int npu_stm32_init(const struct device *dev)
 {
 	const struct device *const clk = DEVICE_DT_GET(STM32_CLOCK_CONTROL_NODE);
@@ -61,8 +50,6 @@ static int npu_stm32_init(const struct device *dev)
 	(void)reset_line_toggle_dt(&cfg->reset_npu);
 	(void)reset_line_toggle_dt(&cfg->reset_cacheaxi);
 
-	npu_risaf_config();
-
 	return 0;
 }
 

diff --git a/soc/st/stm32/stm32n6x/soc.c b/soc/st/stm32/stm32n6x/soc.c
@@ -34,6 +34,46 @@ void soc_reset_hook(void)
 }
 #endif
 
+#define RIF_MASTER_CID1_SEC_PRIV(device)	\
+	do {										\
+		RIMC_MasterConfig_t rimc = {						\
+			.MasterCID = RIF_CID_1,						\
+			.SecPriv = RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV,		\
+		};									\
+		HAL_RIF_RIMC_ConfigMasterAttributes(RIF_MASTER_INDEX_##device, &rimc);	\
+	} while (0)
+
+#define RIF_SLAVE_SEC_PRIV(device)	\
+	HAL_RIF_RISC_SetSlaveSecureAttributes(RIF_RISC_PERIPH_INDEX_##device,		\
+					      RIF_ATTRIBUTE_SEC | RIF_ATTRIBUTE_PRIV)
+
+static void soc_rif_config(void)
+{
+	/* Enable the clock for the RIFSC (RIF Security Controller) */
+	__HAL_RCC_RIFSC_CLK_ENABLE();
+
+	/* DCMIPP */
+	RIF_MASTER_CID1_SEC_PRIV(DCMIPP);
+	RIF_SLAVE_SEC_PRIV(DCMIPP);
+	/* DMA2D */
+	RIF_MASTER_CID1_SEC_PRIV(DMA2D);
+	RIF_SLAVE_SEC_PRIV(DMA2D);
+	/* ETH */
+	RIF_MASTER_CID1_SEC_PRIV(ETH1);
+	RIF_SLAVE_SEC_PRIV(ETH1);
+	/* JPEG */
+	RIF_SLAVE_SEC_PRIV(JPEG);
+	/* LTDC Layer 1 */
+	RIF_MASTER_CID1_SEC_PRIV(LTDC1);
+	RIF_SLAVE_SEC_PRIV(LTDCL1);
+	/* NPU */
+	RIF_MASTER_CID1_SEC_PRIV(NPU);
+	RIF_SLAVE_SEC_PRIV(NPU);
+	/* VENC */
+	RIF_MASTER_CID1_SEC_PRIV(VENC);
+	RIF_SLAVE_SEC_PRIV(VENC);
+}
+
 /**
  * @brief Perform basic hardware initialization at boot.
  *
@@ -66,4 +106,9 @@ void soc_early_init_hook(void)
 	/* Set Vdd IO2 and IO3 to 1.8V */
 	LL_PWR_SetVddIO2VoltageRange(LL_PWR_VDDIO_VOLTAGE_RANGE_1V8);
 	LL_PWR_SetVddIO3VoltageRange(LL_PWR_VDDIO_VOLTAGE_RANGE_1V8);
+
+	/* RIF configuration */
+	if (IS_ENABLED(CONFIG_STM32N6_RIF_OPEN)) {
+		soc_rif_config();
+	}
 }