TU-shared surface for the DFU MRAM program/verify implementation. More...

#include <stdint.h>
#include "ra8_attributes.h"
#include "ra8_err.h"

Include dependency graph for ra8_dfu_internal.h:

This graph shows which files directly or indirectly include this file:

Functions
ra8_err_t	priv_dfu_write_secure (uintptr_t addr, const uint8_t *src, uint32_t len)
	Program `len` bytes at `addr` through the SECURE MRAM gate.

Detailed Description

TU-shared surface for the DFU MRAM program/verify implementation.

Tag: [Ring 4 / Service] {World: S}

Not part of the public DFU API. Carries the handful of ra8_dfu_program.c helpers that are promoted from static to external linkage so their compound decisions can be exercised with independent influence (MC/DC) from the host unit tests. Production callers keep using the public ra8_dfu.h surface; the only consumers of these symbols outside the defining TU are the tests under tests/ (see CLAUDE.md, "Test access to internal symbols").

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Since: 0.1.0

Definition in file ra8_dfu_internal.h.

Function Documentation

◆ priv_dfu_write_secure()

ra8_err_t priv_dfu_write_secure	(	uintptr_t	addr,
		const uint8_t *	src,
		uint32_t	len )

Program len bytes at addr through the SECURE MRAM gate.

The DFU core runs in the secure world and its slot MRAM carries secure attribution, so it must be programmed via MRCPC1 (k_ra8_flash_world_s). This helper drives ra8_flash_write_block directly, one 32-byte page at a time, erasing each page to the all-ones baseline first, with IRQs masked across each page program so no ISR fetches code-MRAM while the array is busy. The soft write-window installed by ra8_dfu_program_prepare is still enforced inside ra8_flash_write_block, so an out-of-slot destination is rejected.

Promoted from TU-private static linkage so the argument guard can be exercised for MC/DC directly (both production callers validate their pointer/length before dispatching here, so neither guard condition is presentable on a public-API path); defined in ra8_dfu_program.c.

Parameters

[in]	addr	32-byte aligned MRAM destination.
[in]	src	Non-NULL source buffer of at least `len` bytes.
[in]	len	Non-zero multiple of the 32-byte page size.

Returns: ra8_err_t from the first failing page, else k_ra8_ok.

Return values

k_ra8_ok	Every page committed.
k_ra8_err_invalid_arg	`src` was NULL or `len` was zero.

Precondition: src non-null and len a non-zero multiple of the page size.; This TU is linked into .sram_text (SRAM-resident program loop).

Postcondition: On success every page in [addr, addr+len) holds src.; The secure program gate is re-locked on every exit path.

Note: Thread-safe: no; masks IRQs across each page program.; Test-access only outside the defining TU.

MC/DC:

Decision: (src == nullptr) || (len == 0U) (2 conditions, ||); the argument guard. N+1 = 3 vectors:

V1: src!=NULL, len!=0 -> F,F -> false (control: proceeds to program)
V2: src==NULL -> T,. -> true (varies left; returns invalid_arg)
V3: src!=NULL, len==0 -> F,T -> true (varies right; returns invalid_arg)

Since: 0.1.0

Program len bytes at addr through the SECURE MRAM gate.

Definition at line 61 of file ra8_dfu_program.c.

References k_ra8_dfu_page_size, k_ra8_dfu_prog_erased_byte, k_ra8_err_invalid_arg, k_ra8_flash_world_s, k_ra8_ok, memset(), ra8_flash_write_block(), RA8_PRIV, ra8_register_guard_enter(), and ra8_register_guard_exit().

Referenced by ra8_dfu_program_commit(), and ra8_dfu_program_image().

Functions

Detailed Description

Function Documentation

◆ priv_dfu_write_secure()