ra8_wdt.c

Go to the documentation of this file.

 
#include "ra8_wdt.h"
 
#include <stdint.h>
 
#include "ra8_attributes.h"
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_hw_err.h"
#include "ra8_icu.h"
#include "ra8_log.h"
#include "ra8_ofs.h"
#include "ra8_wdt_regs.h"

static const char* s_tag = "WDT";

typedef struct {
  ra8_wdt_event_fn_t fn;  
  void*              ctx; 
} ra8_wdt_sub_t;

typedef enum : uint8_t {
  k_ra8_wdt_legacy_slot = 0U, 
} ra8_wdt_legacy_slot_t;

static ra8_wdt_sub_t s_wdt_subs[k_ra8_wdt_max_subs];

RA8_INTERNAL static ra8_err_t internal_default_ofs_reader(uintptr_t ofs_addr, uint32_t* out_word)
{
  if (out_word == nullptr) {
    return k_ra8_err_null_ptr;
  }
  /* HUM Ch 7.1 "Overview" Figure 7.1 "Option-setting memory area" p 279 --
   * the option-setting words live in the extra-MRAM configuration setting
   * area and are ordinary readable memory. */
  const volatile uint32_t* src = (const volatile uint32_t*)ofs_addr;
  *out_word                    = *src;
  return k_ra8_ok;
}

static ra8_wdt_ofs_reader_fn_t s_ofs_reader = internal_default_ofs_reader;

typedef enum : uint16_t {
  k_ra8_wdt_status_all =
    k_ra8_wdt_status_underflow | k_ra8_wdt_status_refresh, 
} ra8_wdt_status_combined_t;
 
/* =============================================================================
 * Internal helpers
 * =============================================================================
 */

RA8_INTERNAL static bool internal_clock_div_is_valid(ra8_wdt_clock_div_t div)
{
  /* HUM Ch 27.2.2 "WDTCR : WDT Control Register", p 1258 -- legal
   * CKS[3:0] encodings are 0x1, 0x4, 0x6, 0x7, 0x8, 0xF only. */
  switch (div) {
    case k_ra8_wdt_clkdiv_4:
    case k_ra8_wdt_clkdiv_64:
    case k_ra8_wdt_clkdiv_128:
    case k_ra8_wdt_clkdiv_512:
    case k_ra8_wdt_clkdiv_2048:
    case k_ra8_wdt_clkdiv_8192:
      return true;
    default:
      return false;
  }
}

RA8_INTERNAL static bool internal_timeout_sel_is_valid(ra8_wdt_timeout_sel_t sel)
{
  /* HUM Ch 27.2.2 "WDTCR" p 1259 */
  bool ok = false;
  switch (sel) {
    case k_ra8_wdt_timeout_1024:
    case k_ra8_wdt_timeout_4096:
    case k_ra8_wdt_timeout_8192:
    case k_ra8_wdt_timeout_16384:
      ok = true;
      break;
    default:
      ok = false;
      break;
  }
  return ok;
}

RA8_INTERNAL static uint16_t internal_pack_wdtcr(const ra8_wdt_cfg_t* cfg)
{
  /* HUM Ch 27.2.2 "WDTCR : WDT Control Register", p 1258 */
  const uint16_t tops = (uint16_t)((uint16_t)cfg->timeout & k_ra8_wdt_mask_tops);
  const uint16_t cks  = (uint16_t)((uint16_t)cfg->clock_div & k_ra8_wdt_mask_cks);
  const uint16_t rpes = (uint16_t)((uint16_t)cfg->window_end & k_ra8_wdt_mask_rpes);
  const uint16_t rpss = (uint16_t)((uint16_t)cfg->window_start & k_ra8_wdt_mask_rpss);
 
  uint16_t word = 0U;
  word |= (uint16_t)(tops << k_ra8_wdt_shift_tops);
  word |= (uint16_t)(cks << k_ra8_wdt_shift_cks);
  word |= (uint16_t)(rpes << k_ra8_wdt_shift_rpes);
  word |= (uint16_t)(rpss << k_ra8_wdt_shift_rpss);
  return word;
}

RA8_INTERNAL static void internal_subs_clear_all(void)
{
  for (uint8_t i = 0U; i < k_ra8_wdt_max_subs; ++i) {
    s_wdt_subs[i].fn  = nullptr;
    s_wdt_subs[i].ctx = nullptr;
  }
}
 
/* =============================================================================
 * Lifecycle
 * =============================================================================
 */
 
[[nodiscard]] ra8_err_t ra8_wdt_init(const ra8_wdt_cfg_t* cfg)
{
  RA8_CHECK_NULL_PTR(cfg, s_tag, "cfg must not be nullptr");
  if (!internal_clock_div_is_valid(cfg->clock_div)) {
    return k_ra8_err_invalid_arg;
  }
  if (!internal_timeout_sel_is_valid(cfg->timeout)) {
    return k_ra8_err_invalid_arg;
  }
 
  volatile r_wdt_regs_t* reg = ra8_wdt();
 
  /* HUM Ch 27.2.2 "WDTCR : WDT Control Register", p 1258 -- one
   * 16-bit transaction commits the timeout / divider / window. */
  reg->WDTCR = internal_pack_wdtcr(cfg);
 
  /* HUM Ch 27.2.4 "WDTRCR : WDT Reset Control Register", p 1262 --
   * RSTIRQS selects internal reset (1) vs NMI / IRQ (0) on
   * underflow or refresh-error. */
  reg->WDTRCR =
    (uint8_t)((cfg->on_expiry == k_ra8_wdt_on_expiry_reset) ? k_ra8_wdt_rcr_rstirqs : 0U);
 
  /* HUM Ch 27.2.5 "WDTCSTPR : WDT Count Stop Control Register",
   * p 1262 -- SLCSTP halts the counter on Sleep / Deep Sleep. */
  reg->WDTCSTPR =
    (uint8_t)((cfg->stop_in_sleep == k_ra8_wdt_sleep_stop_count) ? k_ra8_wdt_cstpr_slcstp : 0U);
 
  /* HUM Ch 27.2.1 "WDTRR : WDT Refresh Register", p 1257 -- the
   * 0x00 / 0xFF unlock sequence is what arms the down-counter in
   * register-start mode, and is harmless in auto-start mode. */
  ra8_wdt_refresh();
 
  ra8_log_info(s_tag, "wdt_init armed");
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_wdt_deinit(void)
{
  volatile r_wdt_regs_t* reg = ra8_wdt();
  /* HUM Ch 27.2.5 "WDTCSTPR : WDT Count Stop Control Register",
   * p 1262 -- the strongest "off" the driver can request is to halt
   * the counter while the CPU is asleep. The peripheral itself
   * cannot be disarmed once started. */
  reg->WDTCSTPR = k_ra8_wdt_cstpr_slcstp;
  internal_subs_clear_all();
  ra8_log_info(s_tag, "wdt_deinit (sleep-stop set)");
  return k_ra8_ok;
}
 
/* =============================================================================
 * Refresh
 * =============================================================================
 */
 
void ra8_wdt_refresh_deferred(void)
{
  /* HUM Ch 27.2.1 "WDTRR : WDT Refresh Register", p 1257 */
  ra8_wdt_refresh();
}
 
[[nodiscard]] ra8_err_t ra8_wdt_refresh_for(ra8_wdt_instance_t which)
{
  if ((uint8_t)which >= k_ra8_wdt_instance_count) {
    return k_ra8_err_invalid_arg;
  }
  /* HUM Ch 27.2.1 "WDTRR : WDT Refresh Register", p 1257 */
  ra8_wdt_refresh_instance(which);
  return k_ra8_ok;
}
 
/* =============================================================================
 * Status read / clear / counter
 * =============================================================================
 */
 
[[nodiscard]] ra8_err_t ra8_wdt_get_status(uint16_t* out_mask)
{
  RA8_CHECK_NULL_PTR(out_mask, s_tag, "out_mask must not be nullptr");
  /* HUM Ch 27.2.3 "WDTSR : WDT Status Register", p 1260 */
  *out_mask = (uint16_t)(ra8_wdt()->WDTSR & k_ra8_wdt_status_all);
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_wdt_clear_status(void)
{
  volatile r_wdt_regs_t* reg = ra8_wdt();
  /* HUM Ch 27.2.3 "WDTSR : WDT Status Register", p 1260 -- UNDFF /
   * REFEF are write-0-to-clear; writing 1 has no effect. We mask
   * out the flag bits and write the result back. */
  reg->WDTSR = (uint16_t)(reg->WDTSR & (uint16_t)~k_ra8_wdt_status_all);
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_wdt_clear_status_blocking(uint16_t mask)
{
  if ((mask & ~k_ra8_wdt_status_all) != 0U) {
    return k_ra8_err_invalid_arg;
  }
  if (mask == k_ra8_wdt_status_none) {
    return k_ra8_ok;
  }
 
  volatile r_wdt_regs_t* reg = ra8_wdt();
 
  /* HUM Ch 27.2.3 "WDTSR : WDT Status Register", p 1261 -- W0C
   * sequence: write the inverse of the bits we want to clear back
   * into WDTSR, then poll until the targeted bits read 0. The
   * (N + 1) PCLKB cycle latency is bounded by the divider; we
   * cap our polls at k_ra8_wdt_clear_max_polls (16384). */
  for (uint32_t poll = 0U; poll < k_ra8_wdt_clear_max_polls; ++poll) {
    /* Build a write value in which only the bits NOT in `mask`
     * remain set; those are the bits we want to leave untouched.
     * Bits inside `mask` are written 0 to clear. */
    const uint16_t write_val = (uint16_t)(reg->WDTSR & (uint16_t)~mask);
    reg->WDTSR               = write_val;
 
#if defined(RA8_OFF_TARGET) && defined(UNIT_TEST)
    /* HUM Ch 27.2.3 "WDTSR : WDT Status Register" p 1260 */
    const bool cleared = ra8_fake_mmio_poll(&reg->WDTSR, poll, ((uint16_t)reg->WDTSR & mask) == 0U);
#else
    /* HUM Ch 27.2.3 "WDTSR : WDT Status Register" p 1260 */
    const bool cleared = ((uint16_t)reg->WDTSR & mask) == 0U;
#endif
    if (cleared) {
      return k_ra8_ok;
    }
  }
 
  ra8_log_error(s_tag, "wdt_clear_status_blocking timed out");
  return k_ra8_err_hw_timeout;
}
 
[[nodiscard]] ra8_err_t ra8_wdt_get_counter(uint16_t* out_count)
{
  RA8_CHECK_NULL_PTR(out_count, s_tag, "out_count must not be nullptr");
  /* HUM Ch 27.2.3 "WDTSR : WDT Status Register", p 1260 -- the live
   * down-counter occupies CNTVAL[13:0]. */
  *out_count = (uint16_t)(ra8_wdt()->WDTSR & k_ra8_wdt_sr_cnt_mask);
  return k_ra8_ok;
}
 
/* =============================================================================
 * Timeout decoding (FSP timeoutGet analogue)
 * =============================================================================
 */
 
[[nodiscard]] ra8_err_t ra8_wdt_timeout_cycles_get(ra8_wdt_timeout_sel_t sel, uint16_t* out_cycles)
{
  RA8_CHECK_NULL_PTR(out_cycles, s_tag, "out_cycles must not be nullptr");
  /* HUM Ch 27.2.2 "WDTCR" p 1259 */
  switch (sel) {
    case k_ra8_wdt_timeout_1024:
      *out_cycles = k_ra8_wdt_cycles_1024;
      return k_ra8_ok;
    case k_ra8_wdt_timeout_4096:
      *out_cycles = k_ra8_wdt_cycles_4096;
      return k_ra8_ok;
    case k_ra8_wdt_timeout_8192:
      *out_cycles = k_ra8_wdt_cycles_8192;
      return k_ra8_ok;
    case k_ra8_wdt_timeout_16384:
      *out_cycles = k_ra8_wdt_cycles_16384;
      return k_ra8_ok;
    default:
      return k_ra8_err_invalid_arg;
  }
}
 
[[nodiscard]] ra8_err_t ra8_wdt_pclkb_divisor(ra8_wdt_clock_div_t div, uint16_t* out_divisor)
{
  RA8_CHECK_NULL_PTR(out_divisor, s_tag, "out_divisor must not be nullptr");
  /* HUM Ch 27.2.2 "WDTCR" p 1258 */
  switch (div) {
    case k_ra8_wdt_clkdiv_4:
      *out_divisor = k_ra8_wdt_div_value_4;
      return k_ra8_ok;
    case k_ra8_wdt_clkdiv_64:
      *out_divisor = k_ra8_wdt_div_value_64;
      return k_ra8_ok;
    case k_ra8_wdt_clkdiv_128:
      *out_divisor = k_ra8_wdt_div_value_128;
      return k_ra8_ok;
    case k_ra8_wdt_clkdiv_512:
      *out_divisor = k_ra8_wdt_div_value_512;
      return k_ra8_ok;
    case k_ra8_wdt_clkdiv_2048:
      *out_divisor = k_ra8_wdt_div_value_2048;
      return k_ra8_ok;
    case k_ra8_wdt_clkdiv_8192:
      *out_divisor = k_ra8_wdt_div_value_8192;
      return k_ra8_ok;
    default:
      return k_ra8_err_invalid_arg;
  }
}
 
[[nodiscard]] ra8_err_t ra8_wdt_total_pclkb_cycles(ra8_wdt_timeout_sel_t sel,
                                                   ra8_wdt_clock_div_t   div,
                                                   uint32_t*             out_pclkb_cycles)
{
  RA8_CHECK_NULL_PTR(out_pclkb_cycles, s_tag, "out_pclkb_cycles must not be nullptr");
 
  uint16_t        cycles  = 0U;
  uint16_t        divisor = 0U;
  const ra8_err_t e1      = ra8_wdt_timeout_cycles_get(sel, &cycles);
  if (e1 != k_ra8_ok) {
    return e1;
  }
  const ra8_err_t e2 = ra8_wdt_pclkb_divisor(div, &divisor);
  if (e2 != k_ra8_ok) {
    return e2;
  }
 
  /* Largest product is 16384 * 8192 = 134_217_728 -- fits 32 bits. */
  *out_pclkb_cycles = (uint32_t)cycles * (uint32_t)divisor;
  return k_ra8_ok;
}
 
/* =============================================================================
 * Single + multi-subscriber callback API
 * =============================================================================
 */
 
[[nodiscard]] ra8_err_t ra8_wdt_attach_handler(ra8_wdt_event_fn_t fn, void* ctx)
{
  /* The legacy attach API maps to the reserved slot 0 -- that way
   * both APIs share the same dispatch table without stomping each
   * other. ``fn == nullptr`` clears the slot. */
  s_wdt_subs[k_ra8_wdt_legacy_slot].fn  = fn;
  s_wdt_subs[k_ra8_wdt_legacy_slot].ctx = ctx;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_wdt_subscribe(ra8_wdt_event_fn_t fn, void* ctx, uint8_t* out_slot)
{
  RA8_CHECK_NULL_PTR(fn, s_tag, "fn must not be nullptr");
 
  /* Walk the table starting at the first non-legacy slot; slot 0 is
   * reserved for ``ra8_wdt_attach_handler``. */
  for (uint8_t i = 1U; i < k_ra8_wdt_max_subs; ++i) {
    if (s_wdt_subs[i].fn == nullptr) {
      s_wdt_subs[i].fn  = fn;
      s_wdt_subs[i].ctx = ctx;
      if (out_slot != nullptr) {
        *out_slot = i;
      }
      return k_ra8_ok;
    }
  }
 
  ra8_log_error(s_tag, "wdt_subscribe table full");
  return k_ra8_err_no_mem;
}
 
[[nodiscard]] ra8_err_t ra8_wdt_unsubscribe(uint8_t slot)
{
  if (slot >= k_ra8_wdt_max_subs) {
    return k_ra8_err_invalid_arg;
  }
  if (s_wdt_subs[slot].fn == nullptr) {
    return k_ra8_err_not_found;
  }
  s_wdt_subs[slot].fn  = nullptr;
  s_wdt_subs[slot].ctx = nullptr;
  return k_ra8_ok;
}
 
uint8_t ra8_wdt_subscriber_count(void)
{
  uint8_t count = 0U;
  for (uint8_t i = 0U; i < k_ra8_wdt_max_subs; ++i) {
    if (s_wdt_subs[i].fn != nullptr) {
      ++count;
    }
  }
  return count;
}
 
RA8_ISR_SAFE
void ra8_wdt_dispatch(void)
{
  volatile r_wdt_regs_t* reg = ra8_wdt();
  /* HUM Ch 27.2.3 "WDTSR : WDT Status Register", p 1260 -- snapshot
   * the flags before clearing, then hand the latched mask to every
   * registered subscriber. */
  const uint16_t mask = (uint16_t)(reg->WDTSR & k_ra8_wdt_status_all);
  reg->WDTSR          = (uint16_t)(reg->WDTSR & (uint16_t)~mask);
 
  for (uint8_t i = 0U; i < k_ra8_wdt_max_subs; ++i) {
    const ra8_wdt_event_fn_t fn  = s_wdt_subs[i].fn;
    void* const              ctx = s_wdt_subs[i].ctx;
    if (fn != nullptr) {
      fn(ctx, mask);
    }
  }
}
 
/* =============================================================================
 * NMI vector wiring (HUM Ch 14.2.14 p 542)
 * =============================================================================
 */
 
[[nodiscard]] ra8_err_t ra8_wdt_install_nmi(void)
{
  /* HUM Ch 14.2.15 "NMICLR" p 544 -- W1C any stale WDT NMI status
   * before unmasking the source so we don't immediately fire on a
   * pre-existing latched flag. */
  const ra8_err_t e_clr = ra8_icu_nmi_clear(k_ra8_wdt_nmier_wdten_mask);
  if (e_clr != k_ra8_ok) {
    return e_clr;
  }
  /* HUM Ch 14.2.14 "NMIER" p 542 -- WDTEN bit 1 (0x2) routes the
   * WDT0 underflow / refresh-error to the Cortex-M85 NMI line. */
  return ra8_icu_nmi_enable(k_ra8_wdt_nmier_wdten_mask);
}
 
[[nodiscard]] ra8_err_t ra8_wdt_uninstall_nmi(void)
{
  /* HUM Ch 14.2.14 "NMIER" p 542 */
  const ra8_err_t e_dis = ra8_icu_nmi_disable(k_ra8_wdt_nmier_wdten_mask);
  if (e_dis != k_ra8_ok) {
    return e_dis;
  }
  /* HUM Ch 14.2.15 "NMICLR" p 544 */
  return ra8_icu_nmi_clear(k_ra8_wdt_nmier_wdten_mask);
}
 
/* =============================================================================
 * Sleep-mode stop control
 * =============================================================================
 */
 
[[nodiscard]] ra8_err_t ra8_wdt_enter_stop(void)
{
  volatile r_wdt_regs_t* reg = ra8_wdt();
  /* HUM Ch 27.2.5 "WDTCSTPR : WDT Count Stop Control Register",
   * p 1262 -- set SLCSTP to halt the counter on Sleep entry. */
  reg->WDTCSTPR = k_ra8_wdt_cstpr_slcstp;
  return k_ra8_ok;
}
 
[[nodiscard]] ra8_err_t ra8_wdt_exit_stop(void)
{
  volatile r_wdt_regs_t* reg = ra8_wdt();
  /* HUM Ch 27.2.5 "WDTCSTPR : WDT Count Stop Control Register",
   * p 1262 -- clear SLCSTP so the counter keeps running in Sleep. */
  reg->WDTCSTPR = 0U;
  return k_ra8_ok;
}
 
/* =============================================================================
 * OFS0 / OFS3 read-only decode
 * =============================================================================
 */
 
[[nodiscard]] ra8_err_t ra8_wdt_ofs_reader_set(ra8_wdt_ofs_reader_fn_t reader)
{
  s_ofs_reader = (reader == nullptr) ? internal_default_ofs_reader : reader;
  return k_ra8_ok;
}

RA8_INTERNAL static bool internal_sel_field_uniform(uint32_t sel, uint32_t shift, uint32_t mask)
{
  const uint32_t field = (sel >> shift) & mask;
  return (field == 0U) || (field == mask);
}

RA8_INTERNAL static bool internal_ofs3_sel_is_legal(uint32_t sel)
{
  return internal_sel_field_uniform(sel, k_ra8_wdt_ofs_shift_tops, k_ra8_wdt_ofs_mask_tops) &&
         internal_sel_field_uniform(sel, k_ra8_wdt_ofs_shift_cks, k_ra8_wdt_ofs_mask_cks) &&
         internal_sel_field_uniform(sel, k_ra8_wdt_ofs_shift_rpes, k_ra8_wdt_ofs_mask_rpes) &&
         internal_sel_field_uniform(sel, k_ra8_wdt_ofs_shift_rpss, k_ra8_wdt_ofs_mask_rpss);
}

RA8_INTERNAL static ra8_err_t internal_read_wdt1_word(uint32_t* out_word)
{
  /* Single-exit (MISRA C 2012 Rule 15.5): the three reads chain on ``e``
   * rather than returning early, so a failure at any word falls straight
   * through to the one return without touching ``*out_word``. */
  ra8_err_t e = k_ra8_err_null_ptr;
  if (out_word != nullptr) {
    uint32_t sel    = 0U;
    uint32_t sec    = 0U;
    uint32_t nonsec = 0U;
 
    e = s_ofs_reader(k_ra8_ofs3_sel_addr, &sel);
    if (e == k_ra8_ok) {
      e = s_ofs_reader(k_ra8_ofs3_sec_addr, &sec);
    }
    if (e == k_ra8_ok) {
      e = s_ofs_reader(k_ra8_ofs3_addr, &nonsec);
    }
    if (e == k_ra8_ok) {
      if (internal_ofs3_sel_is_legal(sel)) {
        const uint32_t mux = sel & (uint32_t)k_ra8_wdt_ofs_field_mask;
        *out_word          = (nonsec & mux) | (sec & ~mux);
      } else {
        ra8_log_error(s_tag, "OFS3_SEL holds a prohibited mixed encoding");
        e = k_ra8_err_invalid_state;
      }
    }
  }
  return e;
}

RA8_INTERNAL static void internal_decode_ofs_word(uint32_t ofsm, ra8_wdt_ofs_decoded_t* out)
{
  const uint8_t strt = (uint8_t)((ofsm >> k_ra8_wdt_ofs_shift_strt) & k_ra8_wdt_ofs_mask_strt);
  const uint8_t tops = (uint8_t)((ofsm >> k_ra8_wdt_ofs_shift_tops) & k_ra8_wdt_ofs_mask_tops);
  const uint8_t cks  = (uint8_t)((ofsm >> k_ra8_wdt_ofs_shift_cks) & k_ra8_wdt_ofs_mask_cks);
  const uint8_t rpes = (uint8_t)((ofsm >> k_ra8_wdt_ofs_shift_rpes) & k_ra8_wdt_ofs_mask_rpes);
  const uint8_t rpss = (uint8_t)((ofsm >> k_ra8_wdt_ofs_shift_rpss) & k_ra8_wdt_ofs_mask_rpss);
  const uint8_t rstirqs =
    (uint8_t)((ofsm >> k_ra8_wdt_ofs_shift_rstirqs) & k_ra8_wdt_ofs_mask_rstirqs);
  const uint8_t stpctl =
    (uint8_t)((ofsm >> k_ra8_wdt_ofs_shift_stpctl) & k_ra8_wdt_ofs_mask_stpctl);
 
  out->cfg.timeout       = (ra8_wdt_timeout_sel_t)tops;
  out->cfg.clock_div     = (ra8_wdt_clock_div_t)cks;
  out->cfg.window_start  = (ra8_wdt_window_start_t)rpss;
  out->cfg.window_end    = (ra8_wdt_window_end_t)rpes;
  out->cfg.on_expiry     = (ra8_wdt_reset_ctrl_t)rstirqs;
  out->cfg.stop_in_sleep = (ra8_wdt_stop_ctrl_t)stpctl;
  out->start_mode        = (ra8_wdt_ofs_strt_t)strt;
  out->auto_start        = (out->start_mode == k_ra8_wdt_ofs_strt_auto);
}
 
[[nodiscard]] ra8_err_t ra8_wdt_ofs_get(ra8_wdt_instance_t which, ra8_wdt_ofs_decoded_t* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "out must not be nullptr");
  if ((uint8_t)which >= k_ra8_wdt_instance_count) {
    return k_ra8_err_invalid_arg;
  }
 
  /* HUM Ch 27.3.8 Table 27.5 "Association between Option Function Select
   * Register m (OFSm) and the WDT registers" p 1269 -- in auto-start mode the
   * seven WDT fields come from OFSm rather than from WDTCR/WDTRCR/WDTCSTPR.
   *
   * WDT0 takes them from OFS0 (HUM Ch 7.2.1 p 280), a single secure-region
   * word. WDT1 takes them from OFS3/OFS3_SEC selected field-by-field by
   * OFS3_SEL (HUM Ch 7.2.6 p 287, Ch 7.2.7 p 289), so it needs three reads.
   *
   * The WDT driver never writes OFSm; only ``ra8_ofs.c`` emits the
   * option-setting sections. Reads go through the hook so tests and
   * non-secure callers can supply their own transport. */
  uint32_t        ofsm = 0U;
  const ra8_err_t e =
    (which == k_ra8_wdt0) ? s_ofs_reader(k_ra8_ofs0_addr, &ofsm) : internal_read_wdt1_word(&ofsm);
  if (e != k_ra8_ok) {
    return e;
  }
 
  internal_decode_ofs_word(ofsm, out);
  return k_ra8_ok;
}