main.c

/*
 * Copyright (c) 2026 The safety-toolbox contributors
 * SPDX-License-Identifier: Apache-2.0
 *
 * Unit tests for the Safe Data API. Built with CONFIG_SAFE_DATA_REDUNDANT=y so
 * the recovery paths are exercised; redundancy-specific assertions are guarded
 * with IS_ENABLED().
 */
 
#include <zephyr/ztest.h>
#include <string.h>
 
#include <safe_data/safe_data.h>
 
struct payload {
    uint32_t a;
    uint16_t b;
    uint8_t  c;
};
 
SAFE_CONTAINER_DEFINE(safe_payload, struct payload);
 
static struct safe_payload sp;
 
static void reset_to(uint32_t a, uint16_t b, uint8_t c)
{
    struct payload v = { .a = a, .b = b, .c = c };
 
    zassert_ok(SAFE_INIT(&sp));
    zassert_ok(SAFE_WRITE(&sp, &v));
}

ZTEST(safe_data, test_init_and_verify)
{
    reset_to(1, 2, 3);
    zassert_ok(SAFE_VERIFY(&sp), "freshly sealed data must verify");
}

ZTEST(safe_data, test_read_roundtrip)
{
    struct payload out;
 
    reset_to(0xDEADBEEF, 0xCAFE, 0x42);
    zassert_ok(SAFE_READ(&sp, &out));
    zassert_equal(out.a, 0xDEADBEEF);
    zassert_equal(out.b, 0xCAFE);
    zassert_equal(out.c, 0x42);
}

ZTEST(safe_data, test_write_reseals)
{
    struct payload v = { .a = 7, .b = 8, .c = 9 };
    struct payload out;
 
    reset_to(0, 0, 0);
    zassert_ok(SAFE_WRITE(&sp, &v));
    zassert_ok(SAFE_VERIFY(&sp));
    zassert_ok(SAFE_READ(&sp, &out));
    zassert_equal(out.a, 7);
}
 
static int mut_add(void *payload, void *user)
{
    struct payload *p = payload;
 
    p->a += *(uint32_t *)user;
    return 0;
}
 
static int mut_abort(void *payload, void *user)
{
    struct payload *p = payload;
 
    ARG_UNUSED(user);
    p->a = 0xFFFFFFFF; /* must be rolled back logically (tag not resealed) */
    return -ERANGE;
}

ZTEST(safe_data, test_update_commits)
{
    uint32_t delta = 5;
    struct payload out;
 
    reset_to(10, 0, 0);
    zassert_ok(SAFE_UPDATE(&sp, mut_add, &delta));
    zassert_ok(SAFE_READ(&sp, &out));
    zassert_equal(out.a, 15);
}

ZTEST(safe_data, test_update_abort_keeps_integrity)
{
    int ret;
 
    struct payload out;
 
    reset_to(10, 0, 0);
    ret = SAFE_UPDATE(&sp, mut_abort, NULL);
    zassert_equal(ret, -ERANGE, "mutator's error must propagate");
 
    /* The mutator wrote a->0xFFFFFFFF then aborted. With the shadow copy
     * the transaction rolls the payload back, leaving the container clean.
     */
    if (IS_ENABLED(CONFIG_SAFE_DATA_REDUNDANT)) {
        zassert_ok(SAFE_VERIFY(&sp), "abort must roll back cleanly");
        zassert_ok(SAFE_READ(&sp, &out));
        zassert_equal(out.a, 10, "payload must be the pre-update value");
    } else {
        /* No rollback buffer: the partial write is detectable. */
        zassert_equal(SAFE_VERIFY(&sp), -EILSEQ);
    }
}

ZTEST(safe_data, test_section_scope)
{
#if defined(CONFIG_SAFE_DATA_GNU_EXTENSIONS)
    struct payload out;
 
    reset_to(1, 0, 0);
    SAFE_SECTION(&sp, p) {
        p->a += 100;
        p->c = 0xAB;
    }
    zassert_ok(SAFE_VERIFY(&sp), "section must reseal on exit");
    zassert_ok(SAFE_READ(&sp, &out));
    zassert_equal(out.a, 101);
    zassert_equal(out.c, 0xAB);
#else
    ztest_test_skip(); /* SAFE_SECTION not in the configured API surface */
#endif
}

ZTEST(safe_data, test_detects_corruption)
{
    reset_to(100, 200, 30);
 
    /* Corrupt the live payload behind the API's back. */
    sp.payload.a = 0x12345678;
 
    if (IS_ENABLED(CONFIG_SAFE_DATA_REDUNDANT)) {
        /* shadow still good -> recoverable; verify is PURE and must
         * not have repaired anything yet.
         */
        struct payload out;
 
        zassert_equal(SAFE_VERIFY(&sp), SAFE_DATA_RECOVERED);
        zassert_equal(sp.payload.a, 0x12345678,
                  "verify must not modify the payload");
 
        /* The locked read repairs in place and reseals. */
        zassert_ok(SAFE_READ(&sp, &out));
        zassert_equal(out.a, 100, "payload must be restored from shadow");
        zassert_equal(sp.payload.a, 100);
    } else {
        zassert_equal(SAFE_VERIFY(&sp), -EILSEQ);
    }
}

ZTEST(safe_data, test_verify_repair_fixes_in_place)
{
    if (!IS_ENABLED(CONFIG_SAFE_DATA_REDUNDANT)) {
        ztest_test_skip(); /* repair requires the shadow copy */
    }
 
    reset_to(100, 200, 30);
    sp.payload.a = 0x12345678;
 
    /* verify_repair (here with external mutual exclusion: single thread)
     * restores the payload; the tag is still stale until a reseal.
     */
    zassert_equal(safe_data_verify_repair(&sp.payload, sizeof(sp.payload),
                          sp._crc, _SAFE_SHADOW(&sp)),
              SAFE_DATA_RECOVERED);
    zassert_equal(sp.payload.a, 100, "repair must restore the payload");
    /* The restored payload matches the stored tag again. */
    zassert_ok(SAFE_VERIFY(&sp));
}

ZTEST(safe_data, test_commit_reseals_external_write)
{
#if !defined(CONFIG_SAFE_DATA_ALLOW_UNCHECKED_COMMIT)
    ztest_test_skip(); /* SAFE_COMMIT not in the configured API surface */
#else
    struct payload out;
 
    reset_to(1, 2, 3);
 
    /* Modify the storage directly (as an audited low-level path might),
     * then SAFE_COMMIT reseals the tag (and refreshes the shadow) over the
     * new contents. commit does not verify first, so this works the same
     * with or without the redundant copy.
     */
    sp.payload.a = 77;
    zassert_ok(SAFE_COMMIT(&sp));
    zassert_ok(SAFE_VERIFY(&sp), "commit must reseal over current contents");
    zassert_ok(SAFE_READ(&sp, &out));
    zassert_equal(out.a, 77);
#endif /* CONFIG_SAFE_DATA_ALLOW_UNCHECKED_COMMIT */
}

ZTEST(safe_data, test_stale_tag_recovers)
{
    struct payload out;
 
    if (!IS_ENABLED(CONFIG_SAFE_DATA_REDUNDANT)) {
        ztest_test_skip(); /* recovery requires the shadow copy */
    }
 
    reset_to(5, 6, 7);
 
    /* Corrupt ONLY the stored tag; payload and shadow stay consistent.
     * verify() must notice the data itself is fine and report RECOVERED.
     */
    sp._crc ^= 0xA5A5A5A5u;
    zassert_equal(SAFE_VERIFY(&sp), SAFE_DATA_RECOVERED,
              "consistent data with a stale tag must be recoverable");
 
    /* A read makes the recovery durable (reseals the tag). */
    zassert_ok(SAFE_READ(&sp, &out));
    zassert_equal(out.a, 5);
    zassert_ok(SAFE_VERIFY(&sp), "tag must be resealed after recovery");
}

ZTEST(safe_data, test_double_fault_unrecoverable)
{
    /* The shadow field only exists when redundancy is compiled in, so this
     * test body must be guarded at compile time (a runtime skip would still
     * try to compile the sp._shadow reference).
     */
#if CONFIG_SAFE_DATA_REDUNDANT
    reset_to(9, 9, 9);
 
    /* Corrupt the payload AND the shadow inconsistently: neither copy can
     * vouch for the other, so the fault is unrecoverable.
     */
    sp.payload.a = 0x11111111u;
    sp._shadow[0] ^= 0xAAu;
    zassert_equal(SAFE_VERIFY(&sp), -EILSEQ,
              "a double fault must be reported as unrecoverable");
#else
    ztest_test_skip(); /* the double-fault path only exists with a shadow */
#endif
}
 
static int mut_noop(void *payload, void *user)
{
    ARG_UNUSED(payload);
    ARG_UNUSED(user);
    return 0;
}

ZTEST(safe_data, test_null_args)
{
    uint32_t crc = 0;
    uint8_t buf[4] = {0};
    uint8_t in[4] = {1, 2, 3, 4};
    uint8_t out[4] = {0};
    const size_t n = sizeof(buf);
 
    /* init: payload and crc required, len > 0; a NULL lock is accepted. */
    zassert_equal(safe_data_init(NULL, NULL, n, &crc, NULL), -EINVAL);
    zassert_equal(safe_data_init(NULL, buf, n, NULL, NULL), -EINVAL);
    zassert_equal(safe_data_init(NULL, buf, 0, &crc, NULL), -EINVAL);
    zassert_ok(safe_data_init(NULL, buf, n, &crc, NULL),
           "NULL lock must be accepted");
 
    /* verify and verify_repair: payload required, len > 0. */
    zassert_equal(safe_data_verify(NULL, n, crc, NULL), -EINVAL);
    zassert_equal(safe_data_verify(buf, 0, crc, NULL), -EINVAL);
    zassert_equal(safe_data_verify_repair(NULL, n, crc, NULL), -EINVAL);
    zassert_equal(safe_data_verify_repair(buf, 0, crc, NULL), -EINVAL);
 
    /* read: payload, crc and out required, len > 0. */
    zassert_equal(safe_data_read(NULL, NULL, n, &crc, NULL, out), -EINVAL);
    zassert_equal(safe_data_read(NULL, buf, n, NULL, NULL, out), -EINVAL);
    zassert_equal(safe_data_read(NULL, buf, n, &crc, NULL, NULL), -EINVAL,
              "read needs an out buffer");
    zassert_equal(safe_data_read(NULL, buf, 0, &crc, NULL, out), -EINVAL);
 
    /* write: payload, crc and in required, len > 0. */
    zassert_equal(safe_data_write(NULL, NULL, n, &crc, NULL, in), -EINVAL);
    zassert_equal(safe_data_write(NULL, buf, n, NULL, NULL, in), -EINVAL);
    zassert_equal(safe_data_write(NULL, buf, n, &crc, NULL, NULL), -EINVAL,
              "write needs an input buffer");
    zassert_equal(safe_data_write(NULL, buf, 0, &crc, NULL, in), -EINVAL);
 
    /* update: payload, crc and mutator required, len > 0. */
    zassert_equal(safe_data_update(NULL, NULL, n, &crc, NULL, mut_noop,
                       NULL), -EINVAL);
    zassert_equal(safe_data_update(NULL, buf, n, NULL, NULL, mut_noop,
                       NULL), -EINVAL);
    zassert_equal(safe_data_update(NULL, buf, n, &crc, NULL, NULL, NULL),
              -EINVAL, "update needs a mutator");
    zassert_equal(safe_data_update(NULL, buf, 0, &crc, NULL, mut_noop,
                       NULL), -EINVAL);
 
#if defined(CONFIG_SAFE_DATA_ALLOW_UNCHECKED_COMMIT)
    /* commit: payload and crc required, len > 0. */
    zassert_equal(safe_data_commit(NULL, NULL, n, &crc, NULL), -EINVAL);
    zassert_equal(safe_data_commit(NULL, buf, n, NULL, NULL), -EINVAL);
    zassert_equal(safe_data_commit(NULL, buf, 0, &crc, NULL), -EINVAL);
#endif
 
    /* stats_get: out required (with or without CONFIG_SAFE_DATA_STATS). */
    zassert_equal(safe_data_stats_get(NULL), -EINVAL);
 
    /* A NULL lock selects the lock-free mode: valid calls succeed. */
    zassert_ok(safe_data_write(NULL, buf, n, &crc, NULL, in));
    zassert_ok(safe_data_read(NULL, buf, n, &crc, NULL, out));
    zassert_mem_equal(out, in, n);
    zassert_ok(safe_data_update(NULL, buf, n, &crc, NULL, mut_noop, NULL));
#if defined(CONFIG_SAFE_DATA_ALLOW_UNCHECKED_COMMIT)
    zassert_ok(safe_data_commit(NULL, buf, n, &crc, NULL));
#endif
    zassert_ok(safe_data_verify(buf, n, crc, NULL));
}
 
#if !defined(CONFIG_SAFE_DATA_ALLOW_UNCHECKED_COMMIT)
/* The header has no prototype here. A weak reference resolves to NULL when
 * the image links no definition, so the test can show that the function is
 * not part of the build without a use that fails to compile.
 */
extern int safe_data_commit(struct k_mutex *lock, void *payload, size_t len,
                uint32_t *crc, void *shadow) __attribute__((weak));
#endif

ZTEST(safe_data, test_reduced_api_surface)
{
    int (*volatile commit_fn)(struct k_mutex *, void *, size_t, uint32_t *,
                  void *) = safe_data_commit;
#if defined(SAFE_COMMIT)
    const bool commit_macro = true;
#else
    const bool commit_macro = false;
#endif
#if defined(SAFE_SECTION)
    const bool section_macro = true;
#else
    const bool section_macro = false;
#endif
    const bool commit_cfg = IS_ENABLED(CONFIG_SAFE_DATA_ALLOW_UNCHECKED_COMMIT);
    const bool section_cfg = IS_ENABLED(CONFIG_SAFE_DATA_GNU_EXTENSIONS);
 
    zassert_equal(commit_macro, commit_cfg,
              "SAFE_COMMIT must exist exactly when it is configured");
    zassert_equal(commit_fn != NULL, commit_cfg,
              "safe_data_commit() must be linked exactly when configured");
    zassert_equal(section_macro, section_cfg,
              "SAFE_SECTION must exist exactly when it is configured");
 
    if (IS_ENABLED(CONFIG_SAFE_DATA_LEVEL_STRICT)) {
        zassert_false(commit_macro, "Strict: no SAFE_COMMIT");
        zassert_is_null(commit_fn, "Strict: no safe_data_commit()");
        zassert_false(section_macro, "Strict: no SAFE_SECTION");
    }
}
 
/* ----------------------------------------------------------------------- *
 * Concurrency: two threads share one container. The mutex inside the
 * container must serialise the producer's read-modify-write against the
 * consumer's reads, so the consumer never observes a torn (internally
 * inconsistent) snapshot. The producer deliberately writes the dependent
 * fields one at a time with yields between them to widen the race window.
 * ----------------------------------------------------------------------- */
struct cc_payload {
    uint32_t seq;
    uint32_t a;
    uint32_t b;
    uint32_t sum; /* invariant: sum == a + b */
};
 
SAFE_CONTAINER_DEFINE(safe_cc, struct cc_payload);
static struct safe_cc cc;
 
#define CC_ITERS 1000
 
static atomic_t cc_breaks;
static atomic_t cc_reads;
 
static int cc_advance(void *payload, void *user)
{
    struct cc_payload *s = payload;
    uint32_t n = ++s->seq;
 
    ARG_UNUSED(user);
 
    s->a = n;
    k_yield(); /* momentarily inconsistent - but under the lock */
    s->b = n * 3U;
    k_yield();
    s->sum = s->a + s->b;
    return 0;
}
 
static K_THREAD_STACK_DEFINE(cc_prod_stack, 2048);
static K_THREAD_STACK_DEFINE(cc_cons_stack, 2048);
static struct k_thread cc_prod;
static struct k_thread cc_cons;
 
static void cc_producer(void *a, void *b, void *c)
{
    ARG_UNUSED(a); ARG_UNUSED(b); ARG_UNUSED(c);
 
    for (int i = 0; i < CC_ITERS; i++) {
        (void)SAFE_UPDATE(&cc, cc_advance, NULL);
        k_yield();
    }
}
 
static void cc_consumer(void *a, void *b, void *c)
{
    struct cc_payload snap;
 
    ARG_UNUSED(a); ARG_UNUSED(b); ARG_UNUSED(c);
 
    for (int i = 0; i < CC_ITERS; i++) {
        if (SAFE_READ(&cc, &snap) == 0) {
            if (snap.sum != snap.a + snap.b) {
                atomic_inc(&cc_breaks);
            }
            atomic_inc(&cc_reads);
        }
        k_yield();
    }
}

ZTEST(safe_data, test_concurrent_access_is_serialised)
{
    struct cc_payload init = {0};
 
    zassert_ok(SAFE_INIT(&cc));
    zassert_ok(SAFE_WRITE(&cc, &init));
    atomic_clear(&cc_breaks);
    atomic_clear(&cc_reads);
 
    k_thread_create(&cc_prod, cc_prod_stack,
            K_THREAD_STACK_SIZEOF(cc_prod_stack), cc_producer,
            NULL, NULL, NULL, 5, 0, K_NO_WAIT);
    k_thread_create(&cc_cons, cc_cons_stack,
            K_THREAD_STACK_SIZEOF(cc_cons_stack), cc_consumer,
            NULL, NULL, NULL, 5, 0, K_NO_WAIT);
 
    zassert_ok(k_thread_join(&cc_prod, K_FOREVER));
    zassert_ok(k_thread_join(&cc_cons, K_FOREVER));
 
    zassert_true(atomic_get(&cc_reads) > 0, "consumer made no reads");
    zassert_equal(atomic_get(&cc_breaks), 0,
              "lock failed to serialise: a torn snapshot was observed");
}
 
/* ----------------------------------------------------------------------- *
 * Diagnostics: self-test, statistics, fault-handler events, contract
 * enforcement, bounded locking.
 * ----------------------------------------------------------------------- */

ZTEST(safe_data, test_selftest)
{
#if defined(CONFIG_SAFE_DATA_SELFTEST)
    zassert_ok(safe_data_selftest(), "integrity mechanism must be healthy");
#else
    ztest_test_skip();
#endif
}

ZTEST(safe_data, test_stats_count_events)
{
#if defined(CONFIG_SAFE_DATA_STATS)
    struct safe_data_stats st;
    struct payload out;
 
    safe_data_stats_reset();
    reset_to(1, 2, 3);
 
    if (IS_ENABLED(CONFIG_SAFE_DATA_REDUNDANT)) {
        /* Corrupt payload -> locked read repairs from the shadow. */
        sp.payload.a = 99;
        zassert_ok(SAFE_READ(&sp, &out));
        zassert_ok(safe_data_stats_get(&st));
        zassert_equal(st.recovered_payload, 1);
 
        /* Corrupt only the stored tag -> recovered by resealing. */
        sp._crc ^= 0xFFu;
        zassert_ok(SAFE_READ(&sp, &out));
        zassert_ok(safe_data_stats_get(&st));
        zassert_equal(st.recovered_tag, 1);
    }
 
    /* Unrecoverable corruption must be counted too. */
#if CONFIG_SAFE_DATA_REDUNDANT
    sp.payload.a ^= 0x1111u;
    sp._shadow[0] ^= 0xAAu;
#else
    sp.payload.a ^= 0x1111u;
#endif
    zassert_equal(SAFE_VERIFY(&sp), -EILSEQ);
    zassert_ok(safe_data_stats_get(&st));
    zassert_equal(st.unrecoverable, 1);
#else
    struct safe_data_stats st;
 
    zassert_equal(safe_data_stats_get(&st), -ENOTSUP);
    ztest_test_skip();
#endif
}
 
static atomic_t cb_count;
static struct safe_data_fault_info cb_last;
 
static void fault_event_cb(const struct safe_data_fault_info *info)
{
    cb_last = *info;
    atomic_inc(&cb_count);
}
 
static void fault_event_cb_other(const struct safe_data_fault_info *info)
{
    ARG_UNUSED(info);
}

ZTEST(safe_data, test_fault_handler_events)
{
    atomic_clear(&cb_count);
    zassert_ok(safe_data_fault_handler_register(fault_event_cb));
    zassert_equal(safe_data_fault_handler_register(fault_event_cb_other),
              -EALREADY, "second handler must be rejected");
    zassert_ok(safe_data_fault_handler_register(fault_event_cb),
           "re-registering the same handler is idempotent");
 
    reset_to(4, 5, 6);
 
    if (IS_ENABLED(CONFIG_SAFE_DATA_REDUNDANT)) {
        struct payload out;
 
        /* Recovery must be observable, not silent. */
        sp.payload.a = 0xBAD;
        zassert_ok(SAFE_READ(&sp, &out));
        zassert_true(atomic_get(&cb_count) >= 1);
        zassert_equal(cb_last.kind,
                  SAFE_DATA_FAULT_KIND_RECOVERED_PAYLOAD);
    }
 
    /* Unrecoverable corruption must reach the handler too. */
#if CONFIG_SAFE_DATA_REDUNDANT
    sp.payload.a ^= 0x2222u;
    sp._shadow[1] ^= 0x55u;
#else
    sp.payload.a ^= 0x2222u;
#endif
    zassert_equal(SAFE_VERIFY(&sp), -EILSEQ);
    zassert_equal(cb_last.kind, SAFE_DATA_FAULT_KIND_UNRECOVERABLE);
    zassert_equal(cb_last.len, sizeof(struct payload));
 
    zassert_ok(safe_data_fault_handler_register(NULL), "unregister");
}
 
static int mut_positive(void *payload, void *user)
{
    struct payload *p = payload;
 
    ARG_UNUSED(user);
    p->a = 0xDEAD;
    return 7; /* contract violation: positive return */
}

ZTEST(safe_data, test_update_clamps_positive_mutator_return)
{
    reset_to(10, 0, 0);
    zassert_equal(SAFE_UPDATE(&sp, mut_positive, NULL), -EINVAL,
              "positive mutator return must be clamped to -EINVAL");
 
    if (IS_ENABLED(CONFIG_SAFE_DATA_REDUNDANT)) {
        struct payload out;
 
        zassert_ok(SAFE_READ(&sp, &out), "clamp must abort + roll back");
        zassert_equal(out.a, 10);
    } else {
        /* No rollback buffer: the partial write is detectable. */
        zassert_equal(SAFE_VERIFY(&sp), -EILSEQ);
    }
 
#if defined(CONFIG_SAFE_DATA_STATS)
    {
        struct safe_data_stats st;
 
        zassert_ok(safe_data_stats_get(&st));
        zassert_true(st.mutator_clamped >= 1);
    }
#endif
}

ZTEST(safe_data, test_write_observes_overwritten_corruption)
{
#if defined(CONFIG_SAFE_DATA_WRITE_CHECKS_OLD) && defined(CONFIG_SAFE_DATA_STATS)
    struct payload v = { .a = 1, .b = 2, .c = 3 };
    struct safe_data_stats st;
 
    reset_to(100, 200, 30);
    safe_data_stats_reset();
 
    /* Corrupt the old contents, then overwrite: the write must succeed
     * but the destroyed evidence must be counted.
     */
    sp.payload.a = 0xBADF00D;
    zassert_ok(SAFE_WRITE(&sp, &v));
    zassert_ok(safe_data_stats_get(&st));
    zassert_equal(st.overwritten, 1,
              "overwritten corruption must be observed");
    zassert_ok(SAFE_VERIFY(&sp));
#else
    ztest_test_skip();
#endif
}
 
#if CONFIG_SAFE_DATA_LOCK_TIMEOUT_MS > 0 && defined(CONFIG_SAFE_DATA_LOCKING)
static int mut_hold(void *payload, void *user)
{
    ARG_UNUSED(payload);
    ARG_UNUSED(user);
    k_sleep(K_MSEC(10 * CONFIG_SAFE_DATA_LOCK_TIMEOUT_MS));
    return 0;
}
 
static K_THREAD_STACK_DEFINE(holder_stack, 2048);
static struct k_thread holder_thread;
 
static void holder_fn(void *a, void *b, void *c)
{
    ARG_UNUSED(a); ARG_UNUSED(b); ARG_UNUSED(c);
    (void)SAFE_UPDATE(&sp, mut_hold, NULL);
}
#endif

ZTEST(safe_data, test_lock_timeout_is_bounded_and_reported)
{
#if CONFIG_SAFE_DATA_LOCK_TIMEOUT_MS > 0 && defined(CONFIG_SAFE_DATA_LOCKING)
    struct payload out;
    struct payload in = { .a = 2, .b = 2, .c = 2 };
    uint32_t delta = 1;
    uint32_t blocked = 0;
#if defined(CONFIG_SAFE_DATA_STATS)
    struct safe_data_stats before;
    struct safe_data_stats after;
#endif
 
    reset_to(1, 1, 1);
#if defined(CONFIG_SAFE_DATA_STATS)
    zassert_ok(safe_data_stats_get(&before));
#endif
 
    k_thread_create(&holder_thread, holder_stack,
            K_THREAD_STACK_SIZEOF(holder_stack), holder_fn,
            NULL, NULL, NULL, 5, 0, K_NO_WAIT);
    /* Let the holder take the container lock. It keeps the lock for ten
     * bounds; the blocked operations below use one bound each.
     */
    k_sleep(K_MSEC(CONFIG_SAFE_DATA_LOCK_TIMEOUT_MS));
 
    zassert_equal(SAFE_READ(&sp, &out), -ETIMEDOUT,
              "blocked read must fail within the configured bound");
    blocked++;
    zassert_equal(SAFE_WRITE(&sp, &in), -ETIMEDOUT,
              "blocked write must fail within the configured bound");
    blocked++;
    zassert_equal(SAFE_UPDATE(&sp, mut_add, &delta), -ETIMEDOUT,
              "blocked update must fail within the configured bound");
    blocked++;
#if defined(CONFIG_SAFE_DATA_ALLOW_UNCHECKED_COMMIT)
    zassert_equal(SAFE_COMMIT(&sp), -ETIMEDOUT,
              "blocked commit must fail within the configured bound");
    blocked++;
#endif
#if defined(CONFIG_SAFE_DATA_GNU_EXTENSIONS)
    {
        bool entered = false;
 
        SAFE_SECTION(&sp, p) {
            entered = true;
            p->a = 0;
        }
        zassert_false(entered,
                  "a blocked SAFE_SECTION must skip its block");
        blocked++;
    }
#endif
 
#if defined(CONFIG_SAFE_DATA_STATS)
    zassert_ok(safe_data_stats_get(&after));
    zassert_equal(after.lock_timeouts - before.lock_timeouts, blocked,
              "each timeout must be observable");
#endif
    ARG_UNUSED(blocked);
 
    zassert_ok(k_thread_join(&holder_thread, K_FOREVER));
    zassert_ok(SAFE_READ(&sp, &out), "container must be usable again");
#else
    ztest_test_skip(); /* needs CONFIG_SAFE_DATA_LOCK_TIMEOUT_MS > 0 */
#endif
}


ZTEST_SUITE(safe_data, NULL, NULL, NULL, NULL, NULL);