ra8_devcfg_store_extra_mram.c File Reference

Production ra8_devcfg_store_t binding over the extra-MRAM window. More...

#include <stddef.h>
#include <stdint.h>
#include <string.h>
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_devcfg.h"
#include "ra8_err.h"
#include "ra8_flash_core.h"
#include "ra8_flash_regs.h"

Include dependency graph for ra8_devcfg_store_extra_mram.c:

Go to the source code of this file.

Enumerations
enum	ra8_devcfg_xm_span_t : uint32_t { k_ra8_devcfg_xm_span }
	End of the devcfg region: copy 1 offset plus one reserved slot. More...

Functions
static ra8_err_t	internal_devcfg_xm_read (uint32_t offset, uint8_t *dst, uint32_t len)
	Extra-MRAM read backend (ra8_devcfg_read_fn_t).
static ra8_err_t	internal_devcfg_xm_write (uint32_t offset, const uint8_t *src, uint32_t len)
	Extra-MRAM write backend (ra8_devcfg_write_fn_t).
const ra8_devcfg_store_t *	ra8_devcfg_default_store (void)
	Return the production extra-MRAM-backed store binding.

Variables
static const char *const	s_tag = "DEVCFG_XM"
	Logging tag for the extra-MRAM backend.
static const ra8_devcfg_store_t	s_default_store
	The process-lifetime extra-MRAM-backed store.

Detailed Description

Production ra8_devcfg_store_t binding over the extra-MRAM window.

Tag

[Ring 4 / Service] {World: NS}

The durable backend for ra8_devcfg: reads dereference the extra-MRAM (data-flash) window at k_ra8_flash_extra_start + offset and writes go through ra8_flash_extra_mram_write in k_ra8_devcfg_page_bytes program pages. The window is untouched by any DFU slot program or erase, so the record survives an A/B update and a rollback alike.

Under RA8_OFF_TARGET (the host unit-test build) both accessors address a RAM shadow instead: the flash MACI registers are modelled by the fake but the extra-MRAM data side is not, so the shadow lets the host exercise the identical read / page-loop / offset control flow without MMIO. Silicon and ra8_emulator take the #else branch and drive the real window.

Note

Blank (never-programmed) extra-MRAM reads back as 0xFF with valid ECC and does NOT bus-fault on the corrected window (#315); no fault-catch probe is needed, and 0xFF fails the record magic so a virgin unit resolves cleanly to UNPROVISIONED.

The window is one-time-programmable (HUM Ch 59.7.4.5); a commit programs a fresh copy slot rather than rewriting one in place.

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file ra8_devcfg_store_extra_mram.c.

Enumeration Type Documentation

ra8_devcfg_xm_span_t

enum ra8_devcfg_xm_span_t : uint32_t

End of the devcfg region: copy 1 offset plus one reserved slot.

The highest byte any store access may touch. Both the RAM shadow size and the silicon bounds guard derive from it, so the two cannot disagree about the region extent.

Enumerator
k_ra8_devcfg_xm_span	One past the last devcfg region byte.

Definition at line 61 of file ra8_devcfg_store_extra_mram.c.

Function Documentation

internal_devcfg_xm_read()

ra8_err_t internal_devcfg_xm_read ( uint32_t offset, uint8_t * dst, uint32_t len )

staticnodiscard

Extra-MRAM read backend (ra8_devcfg_read_fn_t).

On silicon, copies len bytes out of the memory-mapped extra-MRAM window; a blank word reads back as 0xFF without faulting (#315). Off-target, copies from the RAM shadow.

Parameters

[in]	offset	Byte offset into the devcfg region.
[out]	dst	Destination; non-NULL, at least len bytes.
[in]	len	Bytes to read.

Returns

ra8_err_t Error code.

Return values

k_ra8_ok	len bytes copied.
k_ra8_err_null_ptr	dst was NULL.
k_ra8_err_out_of_range	offset + len leaves the devcfg region.

Precondition

dst has room for len bytes.

offset + len lies inside the devcfg region.

Postcondition

On success dst[0 .. len) holds the window contents.

No backing store is programmed.

Note

Not thread-safe; boot / provisioning path only.

Since

0.1.0

Definition at line 150 of file ra8_devcfg_store_extra_mram.c.

References k_ra8_devcfg_xm_span, k_ra8_err_out_of_range, k_ra8_flash_extra_start, k_ra8_ok, memcpy(), RA8_CHECK_NULL_PTR, and s_tag.

internal_devcfg_xm_write()

ra8_err_t internal_devcfg_xm_write ( uint32_t offset, const uint8_t * src, uint32_t len )

staticnodiscard

Extra-MRAM write backend (ra8_devcfg_write_fn_t).

On silicon, programs len bytes through ra8_flash_extra_mram_write in k_ra8_devcfg_page_bytes pages (HUM Ch 59.7.4.5 "Program Command" Table 59.15 p 3592). Off-target, copies into the RAM shadow.

Parameters

[in]	offset	Byte offset into the devcfg region.
[in]	src	Source; non-NULL, at least len bytes.
[in]	len	Bytes to write.

Returns

ra8_err_t Error code.

Return values

k_ra8_ok	len bytes programmed.
k_ra8_err_null_ptr	src was NULL.
k_ra8_err_out_of_range	offset + len leaves the devcfg region.
other	Forwarded from ra8_flash_extra_mram_write.

Precondition

src has len readable bytes; on silicon ra8_flash_init ran.

offset + len lies inside the devcfg region.

Postcondition

On success the window holds src[0 .. len).

On failure the region may be partially programmed.

Note

Not thread-safe; boot / provisioning path only.

Since

0.1.0

Definition at line 198 of file ra8_devcfg_store_extra_mram.c.

References k_ra8_devcfg_page_bytes, k_ra8_devcfg_xm_span, k_ra8_err_out_of_range, k_ra8_flash_extra_start, k_ra8_ok, memcpy(), RA8_CHECK_NULL_PTR, ra8_flash_extra_mram_write(), RA8_RETURN_ON_ERROR, and s_tag.

ra8_devcfg_default_store()

const ra8_devcfg_store_t * ra8_devcfg_default_store

(

void

)

Return the production extra-MRAM-backed store binding.

Wires ra8_devcfg_read_fn_t / ra8_devcfg_write_fn_t to the extra-MRAM (data-flash) window: reads dereference k_ra8_flash_extra_start + offset (a blank word reads back as 0xFF and does not fault – #315), writes go through ra8_flash_extra_mram_write in k_ra8_devcfg_page_bytes pages (HUM Ch 59.7.4.5 "Program Command" Table 59.15 p 3592). Under RA8_OFF_TARGET both members address a RAM shadow so host tests exercise the same control flow without MMIO. The returned pointer has static lifetime; the caller must not free it.

Returns

Pointer to the process-lifetime default store; never NULL.

Return values

non-NULL

The extra-MRAM (or, off-target, RAM-shadow) store.

Precondition

On silicon, ra8_flash_init has run before a commit.

Postcondition

The same pointer is returned on every call.

Both members of the returned store are non-NULL.

Note

Thread-safe (returns a pointer to immutable static data).

See also

ra8_devcfg_load

ra8_devcfg_commit

Since

0.1.0

Definition at line 238 of file ra8_devcfg_store_extra_mram.c.

References s_default_store.

Variable Documentation

s_default_store

const ra8_devcfg_store_t s_default_store

static

Initial value:

                                                = {
  .read  = internal_devcfg_xm_read,
  .write = internal_devcfg_xm_write,
}

The process-lifetime extra-MRAM-backed store.

Wires the read / write backends above; returned by ra8_devcfg_default_store.

Warning

File-private; exposed only through the accessor.

Since

0.1.0

Definition at line 233 of file ra8_devcfg_store_extra_mram.c.

Referenced by ra8_devcfg_default_store().

s_tag

const char* const s_tag = "DEVCFG_XM"

static

Logging tag for the extra-MRAM backend.

Warning

Do not modify.

Since

0.1.0

Definition at line 52 of file ra8_devcfg_store_extra_mram.c.