ota_commit.c

Go to the documentation of this file.

 
#include "ota_commit.h"
 
#include <stdint.h>
 
#include "ra8_check.h"
#include "ra8_err.h"
 
static const char* s_tag = "OTACMT";

static bool s_pending = false;

static ra8_ota_bank_t s_pending_target = k_ra8_ota_bank_a;

static uint32_t s_bank_config = 0U;

ra8_err_t ra8_ota_commit_reset(void)
{
  s_pending        = false;
  s_pending_target = k_ra8_ota_bank_a;
  s_bank_config    = 0U;
  return k_ra8_ok;
}

ra8_err_t ra8_ota_commit_swap_bank(ra8_ota_bank_t target)
{
  if ((target != k_ra8_ota_bank_a) && (target != k_ra8_ota_bank_b)) {
    return k_ra8_err_invalid_arg;
  }
  if (s_pending) {
    return k_ra8_err_invalid_state;
  }
#ifdef RA8_OFF_TARGET
  /* Host shadow: record the armed target so the argument-validation + single-shot
   * idempotency policy stays unit-testable without touching real flash. */
  s_pending_target = target;
  s_pending        = true;
  (void)s_tag;
  return k_ra8_ok;
#else
  /* FAIL-CLOSED on silicon (T5-10). Arming a swap means programming the boot
   * option region (an OFS3 / BTFLG option-byte write behind the PRCR unlock),
   * which is brick-risky and not yet wired -- it is bench-gated. Refuse with a
   * real error instead of a fake k_ra8_ok so a caller can never believe a swap
   * was armed when no flash work happened.
   * TODO(real OFS3/BTFLG boot-bank option-byte swap write -- bench-gated,
   * brick-risky): unlock PRCR, program the boot option byte via ra8_flash_*,
   * re-lock PRCR, confirm by read-back, then arm the shadow and return k_ra8_ok. */
  (void)s_tag;
  return k_ra8_err_not_supported;
#endif
}
 
ra8_err_t ra8_ota_commit_pending(ra8_ota_bank_t* out_target)
{
  RA8_CHECK_NULL_PTR(out_target, s_tag, "pending: out_target");
  if (!s_pending) {
    return k_ra8_err_no_data;
  }
  *out_target = s_pending_target;
  return k_ra8_ok;
}

ra8_err_t ra8_ota_commit_set_bank_config(uint32_t raw_value)
{
  /* Mask reserved bits so an NS caller can only touch the bank-select field.
   * This is the value the real option-region write would persist. */
  const uint32_t masked = raw_value & (uint32_t)k_ra8_ota_bank_config_allowed;
#ifdef RA8_OFF_TARGET
  s_bank_config = masked;
  return k_ra8_ok;
#else
  /* FAIL-CLOSED on silicon (T5-10): persisting the masked value is the same
   * brick-risky, bench-gated option-region write as swap_bank, so refuse rather
   * than report a fake success.
   * TODO(real bank-config option-region write -- bench-gated, brick-risky):
   * unlock PRCR, program `masked` into the option region, re-lock, confirm. */
  (void)masked;
  return k_ra8_err_not_supported;
#endif
}
 
ra8_err_t ra8_ota_commit_get_bank_config(uint32_t* out_value)
{
  RA8_CHECK_NULL_PTR(out_value, s_tag, "get_bank_config: out_value");
  *out_value = s_bank_config;
  return k_ra8_ok;
}