ra8_rsip_devsec.c

Go to the documentation of this file.

 
#include <stdint.h>
 
#include "ra8_check.h"
#include "ra8_err.h"
#include "ra8_log.h"
#include "ra8_rsip.h"
#include "ra8_rsip_regs.h"

/* The fail-closed rebuild (test_ra8_rsip_devsec_failclosed) compiles this TU
 * with RA8_LOG_LEVEL=0, where the check macros discard their tag operand. */
[[maybe_unused]] static const char* s_tag = "RSIP";
 
/*
 * The device-security registers modelled below (lifecycle state, debug level,
 * tamper control / status, DPA arm) are NOT documented RA8D2 registers: HUM
 * Ch 51 "Security Features" (p 3263-3301) is a prose feature index and HUM
 * Ch 52 "Renesas Secure IP (RSIP-E50D)" (p 3302-3307) is a conceptual overview
 * with no register map -- the real state lives in the DLM / option-setting
 * memory / SAU, not an RSIP MMIO word. The command-path bodies here only
 * round-trip the host register fake; they compute no real security state.
 * They compile only under the insecure-stub / off-target guard so a production
 * image gets the fail-closed #else and can never mistake these bytes for a
 * genuine lifecycle / debug / tamper reading. The register pokes below
 * therefore carry NO HUM citation -- there is no real register map to cite; the
 * former "HUM Ch 51.1 / 51.5 / 51.6" citations were fabricated and are removed.
 */
#if defined(RA8_INSECURE_STUB_CRYPTO) || defined(RA8_OFF_TARGET)
 
ra8_err_t ra8_rsip_life_get(ra8_rsip_life_state_t* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "out must not be nullptr");
  *out = (ra8_rsip_life_state_t)*ra8_rsip_reg32(k_ra8_rsip_off_life_state);
  return k_ra8_ok;
}
 
ra8_err_t ra8_rsip_life_advance(ra8_rsip_life_state_t state)
{
  if ((uint32_t)state > k_ra8_rsip_life_rma) {
    return k_ra8_err_invalid_arg;
  }
  const uint32_t cur = *ra8_rsip_reg32(k_ra8_rsip_off_life_state);
  if ((uint32_t)state < cur) {
    return k_ra8_err_invalid_state;
  }
  *ra8_rsip_reg32(k_ra8_rsip_off_life_state) = (uint32_t)state;
  return k_ra8_ok;
}
 
ra8_err_t ra8_rsip_debug_level_get(ra8_rsip_debug_level_t* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "out must not be nullptr");
  *out = (ra8_rsip_debug_level_t)*ra8_rsip_reg32(k_ra8_rsip_off_debug_level);
  return k_ra8_ok;
}
 
ra8_err_t ra8_rsip_debug_level_set(ra8_rsip_debug_level_t level)
{
  if ((uint32_t)level > (uint32_t)k_ra8_rsip_debug_al2) {
    return k_ra8_err_invalid_arg;
  }
  *ra8_rsip_reg32(k_ra8_rsip_off_debug_level) = (uint32_t)level;
  return k_ra8_ok;
}
 
ra8_err_t ra8_rsip_tamper_enable(uint32_t sources)
{
  if ((sources & ~k_ra8_rsip_tamper_src_all) != 0U) {
    return k_ra8_err_invalid_arg;
  }
  *ra8_rsip_reg32(k_ra8_rsip_off_tamper_ctrl) = sources;
  return k_ra8_ok;
}
 
ra8_err_t ra8_rsip_tamper_status(uint32_t* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "out must not be nullptr");
  *out = *ra8_rsip_reg32(k_ra8_rsip_off_tamper_status);
  return k_ra8_ok;
}
 
ra8_err_t ra8_rsip_tamper_ack(uint32_t mask)
{
  if (mask == 0U) {
    return k_ra8_err_invalid_arg;
  }
  if ((mask & ~k_ra8_rsip_tamper_src_all) != 0U) {
    return k_ra8_err_invalid_arg;
  }
  *ra8_rsip_reg32(k_ra8_rsip_off_tamper_status) = mask;
  return k_ra8_ok;
}
 
ra8_err_t ra8_rsip_dpa_arm(bool enable)
{
  volatile uint32_t* ctrl = ra8_rsip_reg32(k_ra8_rsip_off_ctrl);
  if (enable) {
    *ctrl |= k_ra8_rsip_mask_ctrl_dpa_arm;
  } else {
    *ctrl &= ~k_ra8_rsip_mask_ctrl_dpa_arm;
  }
  *ra8_rsip_reg32(k_ra8_rsip_off_dpa_ctrl) = (uint32_t)enable;
  return k_ra8_ok;
}
 
#else /* production build: neither RA8_INSECURE_STUB_CRYPTO nor RA8_OFF_TARGET */
 
/*
 * Fail-closed production variant. With no documented RA8D2 device-security
 * register interface (the real lifecycle / debug / tamper state lives in the
 * DLM / option-setting memory / SAU, not an RSIP MMIO word), every entry point
 * returns a hard error (never k_ra8_ok) and writes no fabricated state, so a
 * production image cannot mistake the fake command-path for a real
 * lifecycle, debug-authorisation, tamper, or side-channel reading.
 */
 
ra8_err_t ra8_rsip_life_get(ra8_rsip_life_state_t* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "life_get: out must not be nullptr");
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_life_advance(ra8_rsip_life_state_t state)
{
  (void)state;
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_debug_level_get(ra8_rsip_debug_level_t* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "debug_level_get: out must not be nullptr");
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_debug_level_set(ra8_rsip_debug_level_t level)
{
  (void)level;
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_tamper_enable(uint32_t sources)
{
  (void)sources;
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_tamper_status(uint32_t* out)
{
  RA8_CHECK_NULL_PTR(out, s_tag, "tamper_status: out must not be nullptr");
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_tamper_ack(uint32_t mask)
{
  (void)mask;
  return k_ra8_err_not_supported;
}
 
ra8_err_t ra8_rsip_dpa_arm(bool enable)
{
  (void)enable;
  return k_ra8_err_not_supported;
}
 
#endif /* RA8_INSECURE_STUB_CRYPTO || RA8_OFF_TARGET */