ra8_cnecc.c

Go to the documentation of this file.

 
#include "ra8_cnecc.h"
 
#include <stdint.h>
 
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_cnecc_regs.h"
#include "ra8_elc_regs.h"
#include "ra8_err.h"
#include "ra8_isr.h"
#include "ra8_log.h"
#include "ra8_mstp.h"

static const char* s_tag = "CNECC";

static const ra8_mstp_t s_cnecc_mstp_table[k_ra8_cnecc_instance_count] = {
  k_ra8_mstp_canfd0,
  k_ra8_mstp_canfd1,
};

static const ra8_elc_event_t s_cnecc_event_table[k_ra8_cnecc_instance_count] = {
  k_ra8_elc_event_can0_mram_eri,
  k_ra8_elc_event_can1_mram_eri,
};

static ra8_cnecc_error_fn_t s_cnecc_fn;

static void* s_cnecc_ctx;

static uint32_t s_cnecc_one_bit_count[k_ra8_cnecc_instance_count];

static uint32_t s_cnecc_two_bit_count[k_ra8_cnecc_instance_count];

static uint32_t s_cnecc_overflow_count[k_ra8_cnecc_instance_count];

static ra8_cnecc_counters_t* s_cnecc_bbr_mirror[k_ra8_cnecc_instance_count];

static ra8_cnecc_config_t s_cnecc_cached_cfg;

static bool s_cnecc_initialized;

static bool s_cnecc_isr_attached;

typedef enum : uint16_t {
  k_ra8_cnecc_isr_ctx_inst_mask = 0x00FFU, 
} ra8_cnecc_isr_const_t;

RA8_INTERNAL
static uint32_t internal_cnecc_ctl_value(const ra8_cnecc_instance_cfg_t* cfg)
{
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register", p 2868
   * Step 2: program IRQ enables + correction permission. The
   * ``EC1ECP`` bit is "correction NOT executed" when SET, so the
   * caller's "correct_1bit = true" maps to bit cleared. */
  uint32_t ctl = 0U;
  if (cfg->irq_1bit) {
    ctl |= k_ra8_cnecc_mask_ec1edic;
  }
  if (cfg->irq_2bit) {
    ctl |= k_ra8_cnecc_mask_ec2edic;
  }
  if (!cfg->correct_1bit) {
    ctl |= k_ra8_cnecc_mask_ec1ecp;
  }
 
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register" EMCA notes,
   * p 2870: writes to ``ECERVF`` are ignored unless ``EMCA[1:0]``
   * is ``01b`` in the same write. Combine the unlock pattern with
   * the ECERVF bit (or omit it for "configured but not running"). */
  ctl |= k_ra8_cnecc_mask_emca_unlock;
  if (cfg->enable) {
    ctl |= k_ra8_cnecc_mask_ecervf;
  }
  return ctl;
}

RA8_INTERNAL
static ra8_err_t internal_apply_instance(uint8_t instance, const ra8_cnecc_instance_cfg_t* cfg)
{
  /* HUM Ch 11.2.8 "MSTPCRC : Module Stop Control Register C", p 447 */
  const ra8_err_t mst_err = ra8_mstp_enable(s_cnecc_mstp_table[instance]);
  RA8_RETURN_ON_ERROR(mst_err, s_tag, "cnecc_init: mstp enable");
 
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  if (reg == nullptr) {              /* GCOVR_EXCL_BR_LINE -- bounded by caller. */
    return k_ra8_err_hw_init_failed; /* GCOVR_EXCL_LINE -- MSTP HW readback      */
  }
 
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register", p 2868
   * Step 1: clear any latched 1-bit / 2-bit / overflow / address
   * flags before turning judgment on, so we start from a clean
   * slate (HUM 42.2.1 p 2870 ECER1C/ECER2C clearing notes). */
  reg->EC710CTL = k_ra8_cnecc_mask_clear_all;
 
  const uint32_t ctl = internal_cnecc_ctl_value(cfg);
 
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register", p 2868 */
  reg->EC710CTL = ctl;
 
  /* Always leave fault-injection mode disabled at init -- the test
   * register defaults to 0 anyway, but a previous test run could
   * have left ECTMCE set (HUM Ch 42.2.2 "EC710TMC : ECC Test Mode
   * Control Register", p 2871). */
  reg->EC710TMC = k_ra8_cnecc_mask_test_disable;
 
  s_cnecc_one_bit_count[instance]  = 0U;
  s_cnecc_two_bit_count[instance]  = 0U;
  s_cnecc_overflow_count[instance] = 0U;
  if (s_cnecc_bbr_mirror[instance] != nullptr) {
    s_cnecc_bbr_mirror[instance]->one_bit_count  = 0U;
    s_cnecc_bbr_mirror[instance]->two_bit_count  = 0U;
    s_cnecc_bbr_mirror[instance]->overflow_count = 0U;
  }
  return k_ra8_ok;
}

RA8_INTERNAL
static void internal_ctl_rmw(volatile r_cnecc_regs_t* reg, uint32_t new_bits, uint32_t mask)
{
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register", p 2868 */
  uint32_t live = reg->EC710CTL;
  /* Drop status / W1C bits (we never want to accidentally clear them
   * on a config rewrite -- callers go through ra8_cnecc_clear_status
   * for that). */
  live &= k_ra8_cnecc_mask_ctl_writable;
  /* Drop the W1C clear bits -- they read 0 but writing 1 latches a
   * clear; we want this RMW to be neutral on the status flags. */
  live &= ~(k_ra8_cnecc_mask_ecer1c | k_ra8_cnecc_mask_ecer2c);
  /* Replace just the requested bits. */
  live = ((live & ~mask) | (new_bits & mask));
  /* Always re-assert the EMCA = 01b unlock pattern (HUM 42.2.1 p 2870
   * EMCA notes). */
  live = ((live & ~k_ra8_cnecc_mask_emca) | k_ra8_cnecc_mask_emca_unlock);
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register", p 2868 */
  reg->EC710CTL = live;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_init(const ra8_cnecc_config_t* cfg)
{
  RA8_CHECK_NULL_PTR(cfg, s_tag, "cfg must not be nullptr");
 
  for (uint8_t i = 0U; i < (uint8_t)k_ra8_cnecc_instance_count; ++i) {
    const ra8_err_t err = internal_apply_instance(i, &cfg->instances[i]);
    RA8_RETURN_ON_ERROR(err, s_tag, "cnecc_init apply");
  }
  s_cnecc_cached_cfg  = *cfg;
  s_cnecc_initialized = true;
  ra8_log_info(s_tag, "cnecc_init");
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_deinit(void)
{
  /* If the ISR was attached, drop those slots first so they don't
   * fire after the MSTP gate closes. */
  if (s_cnecc_isr_attached) {
    (void)ra8_cnecc_detach_isr();
  }
 
  for (uint8_t i = 0U; i < (uint8_t)k_ra8_cnecc_instance_count; ++i) {
    volatile r_cnecc_regs_t* reg = ra8_cnecc(i);
    if (reg != nullptr) {
      /* HUM Ch 42.2.2 "EC710TMC : ECC Test Mode Control Register", p 2871
       * Always leave test mode off when tearing down. */
      reg->EC710TMC = k_ra8_cnecc_mask_test_disable;
      /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register" EMCA notes,
       * p 2870: clearing ``ECERVF`` also requires the EMCA = 01b
       * unlock pattern in the same write. */
      reg->EC710CTL = k_ra8_cnecc_mask_emca_unlock;
    }
    /* HUM Ch 11.2.8 "MSTPCRC : Module Stop Control Register C", p 447 */
    (void)ra8_mstp_disable(s_cnecc_mstp_table[i]);
    s_cnecc_one_bit_count[i]  = 0U;
    s_cnecc_two_bit_count[i]  = 0U;
    s_cnecc_overflow_count[i] = 0U;
  }
  s_cnecc_initialized = false;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_enable_instance(uint8_t instance)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  RA8_CHECK_NULL_PTR(reg, s_tag, "instance mapping failed");
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register", p 2870 */
  internal_ctl_rmw(reg, k_ra8_cnecc_mask_ecervf, k_ra8_cnecc_mask_ecervf);
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_disable_instance(uint8_t instance)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  RA8_CHECK_NULL_PTR(reg, s_tag, "instance mapping failed");
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register", p 2870 */
  internal_ctl_rmw(reg, 0U, k_ra8_cnecc_mask_ecervf);
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_enter_standby(void)
{
  for (uint8_t i = 0U; i < (uint8_t)k_ra8_cnecc_instance_count; ++i) {
    volatile r_cnecc_regs_t* reg = ra8_cnecc(i);
    if (reg == nullptr) {
      continue; /* GCOVR_EXCL_LINE -- bounded loop, ra8_cnecc never NULL here. */
    }
    /* HUM Ch 42.5.1 "Enter Software Standby Mode", p 2876
     * Step 1: clear ECC error flags + address. */
    reg->EC710CTL = k_ra8_cnecc_mask_clear_all;
    /* Step 2: clear ECERVF (with EMCA unlock). */
    reg->EC710CTL = k_ra8_cnecc_mask_emca_unlock;
  }
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_exit_standby(void)
{
  if (!s_cnecc_initialized) {
    return k_ra8_err_not_initialized;
  }
  for (uint8_t i = 0U; i < (uint8_t)k_ra8_cnecc_instance_count; ++i) {
    /* HUM Ch 42.5.2 "Return from Software Standby Mode", p 2876
     * Step 1 + 2: replay cached cfg and re-enable judgment. */
    const ra8_err_t err = internal_apply_instance(i, &s_cnecc_cached_cfg.instances[i]);
    /* GCOVR_EXCL_BR_START -- internal_apply_instance() error edge on the standby replay path */
    RA8_RETURN_ON_ERROR(err, s_tag, "cnecc_exit_standby apply");
    /* GCOVR_EXCL_BR_STOP */
  }
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_set_irq_enables(uint8_t instance, bool irq_1bit, bool irq_2bit)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  RA8_CHECK_NULL_PTR(reg, s_tag, "instance mapping failed");
  uint32_t set_bits = 0U;
  if (irq_1bit) {
    set_bits |= k_ra8_cnecc_mask_ec1edic;
  }
  if (irq_2bit) {
    set_bits |= k_ra8_cnecc_mask_ec2edic;
  }
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register", p 2870 */
  internal_ctl_rmw(reg, set_bits, k_ra8_cnecc_mask_irq_all);
  /* Refresh cached cfg so a later exit_standby preserves the change. */
  s_cnecc_cached_cfg.instances[instance].irq_1bit = irq_1bit;
  s_cnecc_cached_cfg.instances[instance].irq_2bit = irq_2bit;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_set_correction_permission(uint8_t instance, bool correct_1bit)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  RA8_CHECK_NULL_PTR(reg, s_tag, "instance mapping failed");
  /* EC1ECP semantics are inverted: bit set means "correction NOT
   * executed" per HUM Ch 42.2.1 "EC710CTL : ECC Control Register"
   * EC1ECP, p 2870. */
  uint32_t set_bits = k_ra8_cnecc_mask_ec1ecp;
  if (correct_1bit) {
    set_bits = 0U;
  }
  internal_ctl_rmw(reg, set_bits, k_ra8_cnecc_mask_ec1ecp);
  s_cnecc_cached_cfg.instances[instance].correct_1bit = correct_1bit;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_get_status(uint8_t instance, ra8_cnecc_status_t* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "out must not be nullptr");
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  RA8_CHECK_NULL_PTR(reg, s_tag, "instance mapping failed");
 
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register", p 2868 */
  const uint32_t ctl = reg->EC710CTL;
  /* HUM Ch 42.2.2 "EC710TMC : ECC Test Mode Control Register", p 2871 */
  const uint16_t tmc = reg->EC710TMC;
  /* HUM Ch 42.2.4 "EC710EAD0 : ECC Error Address Register", p 2872 */
  const uint32_t ead = reg->EC710EAD0;
 
  out->raw_ctl         = ctl;
  out->raw_tmc         = tmc;
  out->reserved0       = 0U;
  out->one_bit_count   = s_cnecc_one_bit_count[instance];
  out->two_bit_count   = s_cnecc_two_bit_count[instance];
  out->overflow_count  = s_cnecc_overflow_count[instance];
  out->last_addr       = (uint16_t)(ead & k_ra8_cnecc_mask_ecead);
  out->err_present     = ((ctl & k_ra8_cnecc_mask_ecemf) != 0U);
  out->err_1bit        = ((ctl & k_ra8_cnecc_mask_ecer1f) != 0U);
  out->err_2bit        = ((ctl & k_ra8_cnecc_mask_ecer2f) != 0U);
  out->overflow        = ((ctl & k_ra8_cnecc_mask_ecovff) != 0U);
  out->addr_is_1bit    = ((ctl & k_ra8_cnecc_mask_ecsedf0) != 0U);
  out->addr_is_2bit    = ((ctl & k_ra8_cnecc_mask_ecdedf0) != 0U);
  out->judgment_active = ((ctl & k_ra8_cnecc_mask_ecervf) != 0U);
  out->correct_enabled = ((ctl & k_ra8_cnecc_mask_ec1ecp) == 0U);
  out->irq1_enabled    = ((ctl & k_ra8_cnecc_mask_ec1edic) != 0U);
  out->irq2_enabled    = ((ctl & k_ra8_cnecc_mask_ec2edic) != 0U);
  out->test_mode       = ((tmc & k_ra8_cnecc_mask_ectmce) != 0U);
  out->reserved1       = false;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_get_counters(uint8_t instance, ra8_cnecc_counters_t* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "out must not be nullptr");
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  out->one_bit_count  = s_cnecc_one_bit_count[instance];
  out->two_bit_count  = s_cnecc_two_bit_count[instance];
  out->overflow_count = s_cnecc_overflow_count[instance];
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_reset_counters(uint8_t instance)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  s_cnecc_one_bit_count[instance]  = 0U;
  s_cnecc_two_bit_count[instance]  = 0U;
  s_cnecc_overflow_count[instance] = 0U;
  if (s_cnecc_bbr_mirror[instance] != nullptr) {
    s_cnecc_bbr_mirror[instance]->one_bit_count  = 0U;
    s_cnecc_bbr_mirror[instance]->two_bit_count  = 0U;
    s_cnecc_bbr_mirror[instance]->overflow_count = 0U;
  }
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_set_counter_mirror(uint8_t instance, ra8_cnecc_counters_t* mirror)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  s_cnecc_bbr_mirror[instance] = mirror;
  if (mirror != nullptr) {
    /* Seed the mirror with the current driver-local values so the
     * caller does not see a transient zero on first attach. */
    mirror->one_bit_count  = s_cnecc_one_bit_count[instance];
    mirror->two_bit_count  = s_cnecc_two_bit_count[instance];
    mirror->overflow_count = s_cnecc_overflow_count[instance];
  }
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_clear_status(uint8_t instance)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  RA8_CHECK_NULL_PTR(reg, s_tag, "instance mapping failed");
 
  /* HUM Ch 42.2.1 "EC710CTL : ECC Control Register" ECER1C/ECER2C,
   * p 2870: write-1 to both bits clears ECER1F, ECER2F, ECOVFF,
   * ECSEDF0 and ECDEDF0 in one shot, and resets EC710EAD0
   * (HUM 42.2.4 p 2873 "reset by clearing the status flag"). */
  reg->EC710CTL = k_ra8_cnecc_mask_clear_all;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_inject_fault(uint8_t instance, const ra8_cnecc_inject_t* req)
{
  RA8_CHECK_NULL_PTR(req, s_tag, "req must not be nullptr");
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  RA8_CHECK_NULL_PTR(reg, s_tag, "instance mapping failed");
 
  /* HUM Ch 42.3.2 "ECC Decoder Testing", figure 42.2 p 2875.
   * The procedure literal values come straight from the figure --
   * 0x8000 / 0x8080 / 0x8082 -- and re-assert the ETMA = 10b unlock
   * pattern on every write. */
 
  /* Step 1: disable test mode (also clears ECDCS per HUM Ch 42.2.2
   * "EC710TMC : ECC Test Mode Control Register" ECDCS notes, p 2872). */
  reg->EC710TMC = k_ra8_cnecc_mask_test_disable;
 
  /* Step 2: write the substitute value into EC710TED. The caller is
   * responsible for picking a value that differs by 1 or 2 bits
   * from the genuine MBRAM word at the target address; the
   * one_bit_flip flag is recorded in the descriptor for traceability
   * but does not change the register write itself. */
  /* HUM Ch 42.2.3 "EC710TED : ECC Test Substitute Data Register", p 2872 */
  reg->EC710TED = req->substitute;
  (void)req->one_bit_flip; /* Tracked for caller bookkeeping. */
 
  /* Step 3: enable test mode (ETMA unlock + ECTMCE). */
  reg->EC710TMC = k_ra8_cnecc_mask_test_enable;
 
  /* Step 4: select EC710TED as decoder input (sets ECDCS in addition
   * to ECTMCE). After the next MBRAM read the decoder will see the
   * substitute value and either ECER1F or ECER2F will latch
   * depending on the Hamming distance the caller chose. */
  reg->EC710TMC = k_ra8_cnecc_mask_test_subst;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_test_mode_disable(uint8_t instance)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  RA8_CHECK_NULL_PTR(reg, s_tag, "instance mapping failed");
  /* HUM Ch 42.2.2 "EC710TMC : ECC Test Mode Control Register", p 2871 */
  reg->EC710TMC = k_ra8_cnecc_mask_test_disable;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_test_mode_active(uint8_t instance, bool* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "out must not be nullptr");
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  RA8_CHECK_NULL_PTR(reg, s_tag, "instance mapping failed");
  /* HUM Ch 42.2.2 "EC710TMC : ECC Test Mode Control Register", p 2872 */
  *out = ((reg->EC710TMC & k_ra8_cnecc_mask_ectmce) != 0U);
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_attach_handler(ra8_cnecc_error_fn_t fn, void* ctx)
{
  RA8_CHECK_NULL_PTR(fn, s_tag, "fn must not be nullptr");
  s_cnecc_fn  = fn;
  s_cnecc_ctx = ctx;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_attach_isr(uint8_t priority)
{
  if (priority > k_ra8_isr_prio_max) {
    return k_ra8_err_invalid_arg;
  }
  for (uint8_t i = 0U; i < (uint8_t)k_ra8_cnecc_instance_count; ++i) {
    /* HUM Ch 42.4 "Interrupts", p 2875 */
    void* const     instance_ctx = (void*)(uintptr_t)i;
    const ra8_err_t err          = ra8_isr_register(s_cnecc_event_table[i],
                                                    ra8_cnecc_isr_handler,
                                                    instance_ctx,
                                                    priority,
                                                    nullptr);
    if (err != k_ra8_ok) {
      /* Roll back any earlier slot we opened. */
      for (uint8_t j = 0U; j < i; ++j) {
        (void)ra8_isr_unregister(s_cnecc_event_table[j]);
      }
      return err;
    }
  }
  s_cnecc_isr_attached = true;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_detach_isr(void)
{
  for (uint8_t i = 0U; i < (uint8_t)k_ra8_cnecc_instance_count; ++i) {
    /* HUM Ch 42.4 "Interrupts", p 2875 */
    (void)ra8_isr_unregister(s_cnecc_event_table[i]);
  }
  s_cnecc_isr_attached = false;
  return k_ra8_ok;
}
 
RA8_ISR_SAFE
void ra8_cnecc_isr_handler(void* ctx)
{
  const uint8_t instance = (uint8_t)((uintptr_t)ctx & (uintptr_t)k_ra8_cnecc_isr_ctx_inst_mask);
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return; /* GCOVR_EXCL_LINE -- attach packs a valid index. */
  }
  volatile r_cnecc_regs_t* reg = ra8_cnecc(instance);
  if (reg == nullptr) { /* GCOVR_EXCL_BR_LINE -- ISR unit reg fixed non-null */
    return;             /* GCOVR_EXCL_LINE -- ISR unit reg fixed non-null    */
  }
 
  /* HUM Ch 42.3.1 figure 42.1 p 2874:
   *   - Confirm ECC error flags (ECER1F / ECER2F / ECOVFF).
   *   - Confirm ECC error address flags (ECSEDF0 / ECDEDF0).
   *   - Confirm ECC error address (EC710EAD0).
   *   - Clear ECC error flag (ECER1C = 1, ECER2C = 1). */
  const uint32_t ctl  = reg->EC710CTL;
  const uint32_t ead  = reg->EC710EAD0;
  const uint16_t addr = (uint16_t)(ead & k_ra8_cnecc_mask_ecead);
 
  const bool one_bit  = (ctl & k_ra8_cnecc_mask_ecer1f) != 0U;
  const bool two_bit  = (ctl & k_ra8_cnecc_mask_ecer2f) != 0U;
  const bool overflow = (ctl & k_ra8_cnecc_mask_ecovff) != 0U;
 
  /* Dispatch each kind separately so the host callback sees one
   * event per latched bit. 2-bit faults take priority for the
   * "is_2bit" classification when both happen to be set in the
   * same window. */
  if (two_bit) {
    ra8_cnecc_dispatch(instance, true, addr);
  }
  if (one_bit) {
    ra8_cnecc_dispatch(instance, false, addr);
  }
  if (overflow) {
    ra8_cnecc_dispatch_overflow(instance);
  }
 
  /* HUM Ch 42.3.1 "ECC Function Setting", p 2874 */
  reg->EC710CTL = k_ra8_cnecc_mask_clear_all;
}
 
RA8_ISR_SAFE
void ra8_cnecc_dispatch(uint8_t instance, bool is_2bit, uint16_t err_addr)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return;
  }
  if (is_2bit) {
    ++s_cnecc_two_bit_count[instance];
    if (s_cnecc_bbr_mirror[instance] != nullptr) {
      ++s_cnecc_bbr_mirror[instance]->two_bit_count;
    }
  } else {
    ++s_cnecc_one_bit_count[instance];
    if (s_cnecc_bbr_mirror[instance] != nullptr) {
      ++s_cnecc_bbr_mirror[instance]->one_bit_count;
    }
  }
  const ra8_cnecc_error_fn_t fn  = s_cnecc_fn;
  void* const                ctx = s_cnecc_ctx;
  if (fn != nullptr) {
    fn(ctx, instance, is_2bit, err_addr);
  }
}
 
RA8_ISR_SAFE
void ra8_cnecc_dispatch_overflow(uint8_t instance)
{
  if ((uint16_t)instance >= k_ra8_cnecc_instance_count) {
    return;
  }
  ++s_cnecc_overflow_count[instance];
  if (s_cnecc_bbr_mirror[instance] != nullptr) {
    ++s_cnecc_bbr_mirror[instance]->overflow_count;
  }
}
 
/* =============================================================================
 * Code-flash ECC compute / verify (software fallback)
 *
 * The CNECC hardware (HUM Ch 42) only describes runtime read-side ECC for
 * the CANFD MBRAM. The bootloader's anti-rollback and code-flash auditing
 * paths still want a deterministic ECC tag for arbitrary memory regions
 * (e.g. the active firmware slot in MRAM). We expose a small CRC32-style
 * accumulator so callers can keep using the CNECC vocabulary without
 * minting a separate driver.
 * =============================================================================
 */

typedef enum : uint32_t {
  k_ra8_cnecc_crc_seed   = 0xFFFFFFFFUL, 
  k_ra8_cnecc_crc_xorout = 0xFFFFFFFFUL, 
  k_ra8_cnecc_crc_poly   = 0xEDB88320UL, 
} ra8_cnecc_compute_const_t;

typedef enum : uint8_t {
  k_ra8_cnecc_compute_align     = 4U,    
  k_ra8_cnecc_compute_byte_bits = 8U,    
  k_ra8_cnecc_compute_byte_mask = 0xFFU, 
} ra8_cnecc_compute_align_t;

RA8_INTERNAL
static uint32_t internal_crc32(const uint8_t* data, uint32_t bytes)
{
  uint32_t crc = (uint32_t)k_ra8_cnecc_crc_seed;
  for (uint32_t i = 0U; i < bytes; ++i) {
    crc ^= (uint32_t)data[i];
    for (uint8_t b = 0U; b < (uint8_t)k_ra8_cnecc_compute_byte_bits; ++b) {
      const uint32_t mask = (crc & 1UL) != 0UL ? (uint32_t)k_ra8_cnecc_crc_poly : 0UL;
      crc                 = (crc >> 1U) ^ mask;
    }
  }
  return crc ^ (uint32_t)k_ra8_cnecc_crc_xorout;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_open(void)
{
  /* Default config: every instance enabled with correction + IRQs on.
   * Mirrors the typical bring-up pattern in apps that don't care about
   * per-instance tuning. HUM Ch 42.3.1 figure 42.1 p 2874 procedure. */
  const ra8_cnecc_config_t cfg = {
    .instances =
      {
        {.correct_1bit = true, .irq_1bit = true, .irq_2bit = true, .enable = true},
        {.correct_1bit = true, .irq_1bit = true, .irq_2bit = true, .enable = true},
      },
  };
  return ra8_cnecc_init(&cfg);
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_compute(uint32_t addr, uint32_t len, uint32_t* out_ecc)
{
  if (out_ecc == nullptr) {
    return k_ra8_err_null_ptr;
  }
  if (addr == 0U) {
    return k_ra8_err_null_ptr;
  }
  if ((addr % (uint32_t)k_ra8_cnecc_compute_align) != 0U) {
    return k_ra8_err_invalid_arg;
  }
  if (len < (uint32_t)k_ra8_cnecc_compute_align) {
    return k_ra8_err_invalid_arg;
  }
  /* Round down to the nearest 4-byte boundary so the computation is
   * deterministic regardless of trailing bytes. */
  const uint32_t aligned_len = len & ~((uint32_t)k_ra8_cnecc_compute_align - 1U);
  *out_ecc                   = internal_crc32((const uint8_t*)(uintptr_t)addr, aligned_len);
  ra8_log_info_val(s_tag, "compute ecc", *out_ecc);
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_cnecc_verify(uint32_t addr, uint32_t len, uint32_t expected_ecc)
{
  uint32_t        got = 0U;
  const ra8_err_t err = ra8_cnecc_compute(addr, len, &got);
  RA8_RETURN_ON_ERROR(err, s_tag, "verify: compute failed");
  if (got != expected_ecc) {
    ra8_log_error_val(s_tag, "verify mismatch", got);
    return k_ra8_err_crc_mismatch;
  }
  return k_ra8_ok;
}