RSIP-E50D device-security path (lifecycle / debug / tamper / DPA), fail-closed. More...

#include <stdint.h>
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_log.h"
#include "ra8_rsip.h"
#include "ra8_rsip_regs.h"

Include dependency graph for ra8_rsip_devsec.c:

Functions
ra8_err_t	ra8_rsip_life_get (ra8_rsip_life_state_t *out)
	Read the device-lifecycle state.
ra8_err_t	ra8_rsip_life_advance (ra8_rsip_life_state_t state)
	Advance the device lifecycle to a new state.
ra8_err_t	ra8_rsip_debug_level_get (ra8_rsip_debug_level_t *out)
	Read the current debug authorisation level.
ra8_err_t	ra8_rsip_debug_level_set (ra8_rsip_debug_level_t level)
	Set the debug authorisation level.
ra8_err_t	ra8_rsip_tamper_enable (uint32_t sources)
	Enable or disable a set of tamper sources.
ra8_err_t	ra8_rsip_tamper_status (uint32_t *out)
	Read latched tamper-source flags.
ra8_err_t	ra8_rsip_tamper_ack (uint32_t mask)
	Acknowledge tamper-source flags (write-1-to-clear).
ra8_err_t	ra8_rsip_dpa_arm (bool enable)
	Arm or disarm SPA / DPA countermeasures.

Variables
static const char *	s_tag = "RSIP"
	Logger tag used by every ra8_log_* call in this TU.

Detailed Description

RSIP-E50D device-security path (lifecycle / debug / tamper / DPA), fail-closed.

Tag: [Ring 3 / HAL] {World: S}

Device-security slice of the RA8D2 RSIP-E50D HAL: the device-lifecycle state, the three debug-authorisation levels (AL0/AL1/AL2), the tamper subsystem, and the SPA / DPA side-channel arm. It was split out of ra8_rsip_asym.c (issue #216) both to keep every translation unit under the file-size budget and because this cluster is FAIL-CLOSED for a reason distinct from the hash / key fiction in ra8_rsip_asym.c.

These functions used to drive an invented "RSIP security-state" register block (LIFE_STATE @ 0xC0, DEBUG_LEVEL @ 0xC4, TAMPER_CTRL @ 0x14, TAMPER_STATUS @ 0x18, DPA_CTRL @ 0x1C, CTRL.DPA_ARM) inside the RSIP window (base 0x403B0000) and cited HUM Ch 51 "Security Features". That register model is fiction, verified against the manual for issue #216:

HUM Ch 51 "Security Features" (p 3263-3301) is a prose feature INDEX, not a register map. 51.1 lists "Device lifecycle management" and the "Three debug levels" (AL0/AL1/AL2) in words; 51.2 "Tamper Detection" describes tamper as an I/O-port feature whose effects are handled by other blocks and cross-references RTC (Ch 26 timestamp), MRAM (Ch 59 HUK zeroize), and the Battery Backup Function (Ch 12 VBATT zeroize); 51.3 documents the Arm TrustZone IDAU / SAU / MSAU. None of it defines a lifecycle / debug-level / tamper register at an RSIP offset.
HUM Ch 52 "Renesas Secure IP (RSIP-E50D)" (p 3302-3307) is a six-page conceptual overview (block diagrams + an "input key, input data, read result" procedure) with no command-register map at all – the same invented-MMIO finding as #214 / #215 / #181.

The real RA8D2 device-security state does NOT live behind an RSIP MMIO read: the device lifecycle and the secure-debug (AL0/AL1/AL2) authorisation are governed by Device Lifecycle Management (DLM) via the debug / serial- programming interface and the option-setting memory, the TrustZone boundary by the SAU / IDAU registers, and tamper response by the RTC / MRAM / VBATT blocks. A security-state query that fabricates a plausible-looking "secure" answer is worse than one that refuses – a caller could trust a lie about the lifecycle or debug level – so every entry point here FAILS CLOSED in a production build: it returns k_ra8_err_not_supported and writes no fabricated state. The insecure off-target command path (which only round-trips the register fake) is retained behind the established stub-crypto guard so ra8_rsip_devsec.c is enforced by check_stub_crypto_guarded.py; a production image compiles the fail-closed #else and can never mistake the fake bytes for a real lifecycle / debug / tamper state.

Note: TODO(no in-tree DLM / option-byte / secure-debug driver): there is no real RA8D2 device-lifecycle / debug-authorisation / tamper backend in this tree today, and this path has zero production consumers. When a consumer genuinely needs real security state, wire it to the DLM / option-setting- memory / SAU source rather than re-enabling the invented RSIP registers.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Since: 0.1.0

Definition in file ra8_rsip_devsec.c.

Function Documentation

◆ ra8_rsip_debug_level_get()

ra8_err_t ra8_rsip_debug_level_get ( ra8_rsip_debug_level_t * out )

nodiscard

Read the current debug authorisation level.

Parameters

[out] out Receives the level (AL0/AL1/AL2).

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Snapshot returned.
k_ra8_err_null_ptr	out was NULL.

Precondition: out is non-NULL.; ra8_rsip_init has been called.

Postcondition: *out is one of AL0/AL1/AL2.; No engine state is modified.

Note: Thread safety: read-only.

Since: 0.1.0

Definition at line 199 of file ra8_rsip_devsec.c.

References k_ra8_err_not_supported, RA8_CHECK_NULL_PTR, and s_tag.

◆ ra8_rsip_debug_level_set()

ra8_err_t ra8_rsip_debug_level_set ( ra8_rsip_debug_level_t level )

nodiscard

Set the debug authorisation level.

Parameters

[in] level Target level.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Level applied.
k_ra8_err_invalid_arg	level out of range.

Precondition: level is one of ra8_rsip_debug_level_t.; Lifecycle state allows the requested level.

Postcondition: Subsequent ra8_rsip_debug_level_get returns level.

Note: Thread safety: not thread-safe.

Since: 0.1.0

Definition at line 205 of file ra8_rsip_devsec.c.

References k_ra8_err_not_supported.

◆ ra8_rsip_dpa_arm()

ra8_err_t ra8_rsip_dpa_arm ( bool enable )

nodiscard

Arm or disarm SPA / DPA countermeasures.

Parameters

[in] enable true to arm, false to disarm.

Returns: ra8_err_t error code.

Return values

k_ra8_ok Done.

Precondition: ra8_rsip_init has been called.; Engine is idle.

Postcondition: CTRL.DPA_ARM matches enable.; Subsequent crypto ops run with countermeasures as requested.

Note: Thread safety: not thread-safe.

Since: 0.1.0

Definition at line 229 of file ra8_rsip_devsec.c.

References k_ra8_err_not_supported.

◆ ra8_rsip_life_advance()

ra8_err_t ra8_rsip_life_advance ( ra8_rsip_life_state_t state )

nodiscard

Advance the device lifecycle to a new state.

Lifecycle transitions are one-way (HUM Ch 51.1 p 3263). The engine rejects backward moves with k_ra8_err_invalid_state.

Parameters

[in] state Target lifecycle state.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Transition complete.
k_ra8_err_invalid_arg	Unknown state.
k_ra8_err_invalid_state	Transition would move backward.
k_ra8_err_hw_timeout	Engine never signalled DONE.

Precondition: state is one of ra8_rsip_life_state_t.; state is forward of the current state.

Postcondition: Subsequent ra8_rsip_life_get returns state.

Note: Thread safety: not thread-safe.

Warning: Lifecycle transitions are irreversible.

Since: 0.1.0

Definition at line 193 of file ra8_rsip_devsec.c.

References k_ra8_err_not_supported.

◆ ra8_rsip_life_get()

ra8_err_t ra8_rsip_life_get ( ra8_rsip_life_state_t * out )

nodiscard

Read the device-lifecycle state.

Parameters

[out] out Receives the lifecycle word.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Snapshot returned.
k_ra8_err_null_ptr	out was NULL.

Precondition: out is non-NULL.; ra8_rsip_init has been called.

Postcondition: *out reflects LIFE_STATE.; No engine state is modified.

Note: Thread safety: read-only.

Since: 0.1.0

Definition at line 187 of file ra8_rsip_devsec.c.

References k_ra8_err_not_supported, RA8_CHECK_NULL_PTR, and s_tag.

◆ ra8_rsip_tamper_ack()

ra8_err_t ra8_rsip_tamper_ack ( uint32_t mask )

nodiscard

Acknowledge tamper-source flags (write-1-to-clear).

Parameters

[in] mask Bits to clear.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Bits cleared.
k_ra8_err_invalid_arg	mask had bits outside the field.

Precondition: mask AND-clean against k_ra8_rsip_tamper_src_all.; mask is non-zero.

Postcondition: Requested bits read as zero.

Note: Thread safety: not thread-safe.

Since: 0.1.0

Definition at line 223 of file ra8_rsip_devsec.c.

References k_ra8_err_not_supported.

◆ ra8_rsip_tamper_enable()

ra8_err_t ra8_rsip_tamper_enable ( uint32_t sources )

nodiscard

Enable or disable a set of tamper sources.

Parameters

[in] sources OR of k_ra8_rsip_tamper_src_* bits to enable.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Mask applied.
k_ra8_err_invalid_arg	sources has bits outside the documented mask.

Precondition: sources AND-clean against k_ra8_rsip_tamper_src_all.; ra8_rsip_init has been called.

Postcondition: TAMPER_CTRL reads as sources.

Note: Thread safety: not thread-safe.

Since: 0.1.0

Definition at line 211 of file ra8_rsip_devsec.c.

References k_ra8_err_not_supported.

◆ ra8_rsip_tamper_status()

ra8_err_t ra8_rsip_tamper_status ( uint32_t * out )

nodiscard

Read latched tamper-source flags.

Parameters

[out] out Receives the flag word.

Returns: ra8_err_t error code.

Return values

k_ra8_ok	Snapshot returned.
k_ra8_err_null_ptr	out was NULL.

Precondition: out is non-NULL.; ra8_rsip_init has been called.

Postcondition: *out reflects TAMPER_STATUS.; No engine state is modified.

Note: Thread safety: read-only.

Since: 0.1.0

Definition at line 217 of file ra8_rsip_devsec.c.

References k_ra8_err_not_supported, RA8_CHECK_NULL_PTR, and s_tag.

Variable Documentation

◆ s_tag

const char* s_tag = "RSIP"

static

Logger tag used by every ra8_log_* call in this TU.

Kept short ("RSIP") so it fits in the fixed-width log prefix without truncation. Each RSIP translation unit keeps its own private copy.

Note: Static, file-scope.

Since: 0.1.0

Definition at line 82 of file ra8_rsip_devsec.c.

Functions

Variables

Detailed Description

Function Documentation

◆ ra8_rsip_debug_level_get()

◆ ra8_rsip_debug_level_set()

◆ ra8_rsip_dpa_arm()

◆ ra8_rsip_life_advance()

◆ ra8_rsip_life_get()

◆ ra8_rsip_tamper_ack()

◆ ra8_rsip_tamper_enable()

◆ ra8_rsip_tamper_status()

Variable Documentation

◆ s_tag