ra8_nsc_ota.c File Reference

NSC veneers: OTA bank-commit + flash-bank-config write. More...

#include <stdint.h>
#include "ota_commit.h"
#include "ra8_err.h"
#include "ra8_nsc.h"
#include "ra8_nsc_veneer.h"

Include dependency graph for ra8_nsc_ota.c:

Go to the source code of this file.

Functions
ra8_err_t	ra8_nsc_ota_commit (uint8_t target_bank)
	NSC veneer: persist an OTA bank-swap commit.
ra8_err_t	ra8_nsc_flash_bank_config (uint32_t raw_value)
	NSC veneer: write the flash bank-config word.

Detailed Description

NSC veneers: OTA bank-commit + flash-bank-config write.

Tag

[Ring 4 / NSC] {World: NSC}

The two veneers in this TU bridge the NS-side OTA agent into the secure-only privileged operations:

• ra8_nsc_ota_commit: validates target_bank and forwards to ra8_ota_commit_swap_bank.
• ra8_nsc_flash_bank_config: forwards a 32-bit value through ra8_ota_commit_set_bank_config (which masks down to the allowed bits).

No pointers cross the boundary, so no NS-region range check is needed in these veneers.

Copyright

Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Definition in file ra8_nsc_ota.c.

Function Documentation

ra8_nsc_flash_bank_config()

ra8_err_t ra8_nsc_flash_bank_config ( uint32_t raw_value )

nodiscard

NSC veneer: write the flash bank-config word.

Forwards the 32-bit raw value through ra8_ota_commit_set_bank_config which masks it down to the allowed bits inside the secure world. The veneer's value is in labelling the operation as crossing the security boundary, so static analysis can flag NS-side callers.

Parameters

[in]

raw_value

Caller-supplied bank-config word.

Returns

ra8_err_t outcome.

Return values

k_ra8_ok	Bank-config word latched (after secure mask).
k_ra8_err_invalid_arg	Secure side rejected the value.

Precondition

TrustZone substrate up.

Caller has authority to mutate the bank-config (policy is enforced in the secure world).

Postcondition

On success the persisted bank-config word is updated.

On failure no flash bytes were written.

TrustZone:

NS->S boundary via cmse_nonsecure_entry. Scalar argument only; the secure side is responsible for masking off bits the NS world is not permitted to flip.

Note

Thread-safe: serialised by the secure ra8_ota lock.

Since

0.1.0

Definition at line 89 of file ra8_nsc_ota.c.

References RA8_NSC_VENEER, and ra8_ota_commit_set_bank_config().

ra8_nsc_ota_commit()

ra8_err_t ra8_nsc_ota_commit ( uint8_t target_bank )

nodiscard

NSC veneer: persist an OTA bank-swap commit.

NSC veneer: commit OTA target bank as the boot bank.

Validates target_bank and forwards to ra8_ota_commit_swap_bank in the secure world.

Parameters

[in]

target_bank

Bank to boot from (k_ra8_ota_bank_a/b).

Returns

ra8_err_t outcome.

Return values

k_ra8_ok	Bank-swap latched.
k_ra8_err_invalid_arg	Unknown bank index.

Precondition

TrustZone substrate initialized.

Caller has verified the new image.

Postcondition

On success the next NVIC reset boots from target_bank.

On failure the active bank is unchanged.

Note

Thread-safe: serialised by the secure ra8_ota lock.

Since

0.1.0

Definition at line 52 of file ra8_nsc_ota.c.

References k_ra8_err_invalid_arg, k_ra8_ota_bank_a, k_ra8_ota_bank_b, RA8_NSC_VENEER, and ra8_ota_commit_swap_bank().