feat(code): introduce dma2d syscalls

[no changelog]

core/embed/gfx/bitblt/gfx_bitblt.c

@@ -17,7 +17,9 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#include "dma2d_bitblt.h"
+#include <gfx/dma2d_bitblt.h>
+
+#ifdef KERNEL_MODE
 
 void gfx_bitblt_init(void) {
 #if defined(USE_DMA2D) && !defined(TREZOR_EMULATOR)
@@ -31,6 +33,8 @@ void gfx_bitblt_deinit(void) {
 #endif
 }
 
+#endif  // KERNEL_MODE
+
 void gfx_bitblt_wait(void) {
 #if defined(USE_DMA2D) && !defined(TREZOR_EMULATOR)
   dma2d_wait();

core/embed/gfx/bitblt/gfx_bitblt_rgb565.c

@@ -20,7 +20,7 @@
 #include <gfx/gfx_bitblt.h>
 
 #if USE_DMA2D
-#include "dma2d_bitblt.h"
+#include <gfx/dma2d_bitblt.h>
 #endif
 
 void gfx_rgb565_fill(const gfx_bitblt_t* bb) {

core/embed/gfx/bitblt/gfx_bitblt_rgba8888.c

@@ -20,7 +20,7 @@
 #include <gfx/gfx_bitblt.h>
 
 #if USE_DMA2D
-#include "dma2d_bitblt.h"
+#include <gfx/dma2d_bitblt.h>
 #endif
 
 void gfx_rgba8888_fill(const gfx_bitblt_t* bb) {

core/embed/gfx/bitblt/stm32/dma2d_bitblt.c

@@ -17,13 +17,14 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#ifdef KERNEL_MODE
+
 #include <trezor_bsp.h>
 #include <trezor_rtl.h>
 
+#include <gfx/dma2d_bitblt.h>
 #include <gfx/gfx_color.h>
 
-#include "../dma2d_bitblt.h"
-
 // Number of DMA2D layers - background (0) and foreground (1)
 #define DMA2D_LAYER_COUNT 2
 
@@ -907,14 +908,6 @@ bool dma2d_rgba8888_copy_y(const gfx_bitblt_t* bb) {
   return true;
 }
 
-// Temporary hack to invalidate CLUT cache used in jpeg decoder.
-// This function should be removed in the future with DMA2D syscalls.
-void dma2d_invalidate_clut(void) {
-  dma2d_driver_t* drv = &g_dma2d_driver;
-  if (!drv->initialized) {
-    return;
-  }
-  drv->clut_valid = false;
-}
-
 #endif  // USE_HW_JPEG_DECODER
+
+#endif  // KERNEL_MODE

core/embed/gfx/inc/gfx/dma2d_bitblt.h

@@ -21,12 +21,16 @@
 
 #include <gfx/gfx_bitblt.h>
 
+#ifdef KERNEL_MODE
+
 // Initializes DMA2D peripheral
 void dma2d_init(void);
 
 // Deinitializes DMA2D peripheral
 void dma2d_deinit(void);
 
+#endif
+
 // Waits until any pending DMA2D operation is finished
 void dma2d_wait(void);
 

core/embed/gfx/inc/gfx/gfx_bitblt.h

@@ -17,8 +17,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef GFX_BITBLT_H
+#pragma once
-#define GFX_BITBLT_H
 
 #include <trezor_types.h>
 
@@ -78,12 +77,16 @@ typedef struct {
 
 } gfx_bitblt_t;
 
+#ifdef KERNEL_MODE
+
 // Initializes bitblt operations
 void gfx_bitblt_init(void);
 
 // Deinitializes bitblt operations
 void gfx_bitblt_deinit(void);
 
+#endif  // KERNEL_MODE
+
 // If the bitblt operation is asynchronous, waits until it's finished
 void gfx_bitblt_wait(void);
 
@@ -133,5 +136,3 @@ void gfx_mono8_blend_mono1p(const gfx_bitblt_t* bb);
 // Blends a mono bitmap (with 4-bit alpha channel)
 // with the destination bitmap
 void gfx_mono8_blend_mono4(const gfx_bitblt_t* bb);
-
-#endif  // GFX_BITBLT_H

core/embed/gfx/jpegdec/stm32u5/jpegdec.c

@@ -22,14 +22,11 @@
 #include <trezor_bsp.h>
 #include <trezor_rtl.h>
 
+#include <gfx/dma2d_bitblt.h>
 #include <gfx/jpegdec.h>
 #include <rtl/sizedefs.h>
 #include <sys/systick.h>
 
-#include <../bitblt/dma2d_bitblt.h>
-
-#include <sys/trustzone.h>
-
 // Fixes of STMicro bugs in cmsis-device-u5
 #undef JPEG_BASE_S
 #define JPEG_BASE_S (AHB1PERIPH_BASE_S + 0x0A000UL)
@@ -441,10 +438,6 @@ bool jpegdec_get_slice_rgba8888(uint32_t *rgba8888, jpegdec_slice_t *slice) {
 
   bool result = false;
 
-#ifdef KERNEL
-  tz_set_dma2d_unpriv(false);
-#endif
-
   switch (dec->image.format) {
     case JPEGDEC_IMAGE_YCBCR420:
       result = dma2d_rgba8888_copy_ycbcr420(&bb);
@@ -467,10 +460,6 @@ bool jpegdec_get_slice_rgba8888(uint32_t *rgba8888, jpegdec_slice_t *slice) {
   // data in the `rgba8888` buffer immediately.
   dma2d_wait();
 
-#ifdef KERNEL
-  tz_set_dma2d_unpriv(true);
-#endif
-
   return result;
 }
 

core/embed/io/display/ltdc_dsi/display_fb.c

@@ -69,10 +69,6 @@ void display_set_unpriv_access(bool unpriv) {
     tz_set_gfxmmu_unpriv(unpriv);
   }
 #endif
-
-#ifdef USE_DMA2D
-  tz_set_dma2d_unpriv(unpriv);
-#endif
 }
 #endif  //  USE_TRUSTZONE
 
@@ -121,11 +117,11 @@ bool display_get_frame_buffer(display_fb_info_t *fb) {
     return false;
   }
 
-  fb->addr = get_fb_ptr(fb_idx);
+  fb->ptr = get_fb_ptr(fb_idx);
   fb->stride = FRAME_BUFFER_PIXELS_PER_LINE * FB_PIXEL_SIZE;
   fb->size = fb->stride * DISPLAY_RESY;
 
-  mpu_set_active_fb(fb->addr, fb->size);
+  mpu_set_active_fb(fb->ptr, fb->size);
 
   return true;
 }

core/embed/io/display/st-7789/display_fb.c

@@ -84,10 +84,6 @@ void display_set_unpriv_access(bool unpriv) {
   tz_set_sram_unpriv((uint32_t)physical_frame_buffer_1,
                      PHYSICAL_FRAME_BUFFER_SIZE, unpriv);
 #endif
-
-#ifdef USE_DMA2D
-  tz_set_dma2d_unpriv(unpriv);
-#endif
 }
 #endif  // USE_TRUSTZONE
 

core/embed/projects/firmware/main.c

@@ -45,9 +45,6 @@
 #endif
 
 int main(uint32_t cmd, void *arg) {
-  // This call will be removed in the future with DMA2D syscalls.
-  gfx_bitblt_init();
-
   if (cmd == 1) {
     systask_postmortem_t *info = (systask_postmortem_t *)arg;
     rsod_gui(info);

core/embed/sys/mpu/inc/sys/mpu.h

@@ -76,7 +76,11 @@ void mpu_restore(mpu_mode_t mode);
 //
 // Addr and size must be aligned to the 32-byte boundary.
 // If addr == 0, the framebuffer is not accessible.
-void mpu_set_active_fb(void* addr, size_t size);
+void mpu_set_active_fb(const void* addr, size_t size);
+
+// Returns true if the given address and size are inside
+// the active framebuffer previously set by `mpu_set_active_fb()`.
+bool mpu_inside_active_fb(const void* addr, size_t size);
 
 #endif  // KERNEL_MODE
 

core/embed/sys/mpu/stm32f4/mpu.c

@@ -198,10 +198,15 @@ mpu_mode_t mpu_get_mode(void) {
   return drv->mode;
 }
 
-void mpu_set_active_fb(void* addr, size_t size) {
+void mpu_set_active_fb(const void* addr, size_t size) {
   // Not implemented on STM32F4
 }
 
+bool mpu_inside_active_fb(const void* addr, size_t size) {
+  // Not implemented on STM32F4
+  return false;
+}
+
 // STM32F4xx memory map
 //
 // 0x08000000  2MB    FLASH
@@ -347,11 +352,6 @@ mpu_mode_t mpu_reconfig(mpu_mode_t mode) {
       SET_REGION( 7, 0x00000000,            SIZE_4GB,  0xBB, SRAM,     FULL_ACCESS );
     break;
 #else
-    case MPU_MODE_APP:
-      // Dma2D (Unprivileged, Read-Write, Non-Executable)
-      // 3KB = 4KB except 1/4 at end
-      SET_REGION( 7, 0x4002B000,            SIZE_4KB,  0xC0, PERIPH,     FULL_ACCESS );
-      break;
     default:
       // All Peripherals (Privileged, Read-Write, Non-Executable)
       SET_REGION( 7, PERIPH_BASE,           SIZE_1GB,  0x00, PERIPH,     PRIV_RW );

core/embed/sys/mpu/stm32u5/mpu.c

@@ -262,7 +262,7 @@ mpu_mode_t mpu_get_mode(void) {
   return drv->mode;
 }
 
-void mpu_set_active_fb(void* addr, size_t size) {
+void mpu_set_active_fb(const void* addr, size_t size) {
   mpu_driver_t* drv = &g_mpu_driver;
 
   if (!drv->initialized) {
@@ -279,6 +279,24 @@ void mpu_set_active_fb(void* addr, size_t size) {
   mpu_reconfig(drv->mode);
 }
 
+bool mpu_inside_active_fb(const void* addr, size_t size) {
+  mpu_driver_t* drv = &g_mpu_driver;
+
+  if (!drv->initialized) {
+    return false;
+  }
+
+  irq_key_t lock = irq_lock();
+
+  bool result =
+      ((uintptr_t)addr >= drv->active_fb_addr) &&
+      ((uintptr_t)addr + size <= drv->active_fb_addr + drv->active_fb_size);
+
+  irq_unlock(lock);
+
+  return result;
+}
+
 mpu_mode_t mpu_reconfig(mpu_mode_t mode) {
   mpu_driver_t* drv = &g_mpu_driver;
 
@@ -368,10 +386,6 @@ mpu_mode_t mpu_reconfig(mpu_mode_t mode) {
       SET_REGION( 7, SAES_RAM_START,           SAES_RAM_SIZE,      SRAM,        YES,   YES ); // Unprivileged kernel SRAM
       break;
 #endif
-    case MPU_MODE_APP:
-      // DMA2D peripherals (Unprivileged, Read-Write, Non-Executable)
-      SET_REGION( 7, 0x5002B000,               SIZE_3K,            PERIPHERAL,  YES,   YES );
-      break;
     default:
       // All peripherals (Privileged, Read-Write, Non-Executable)
       SET_REGION( 7, PERIPH_BASE_NS,           PERIPH_SIZE,        PERIPHERAL,  YES,    NO );

core/embed/sys/syscall/stm32/syscall_dispatch.c

@@ -21,6 +21,7 @@
 
 #include <trezor_rtl.h>
 
+#include <gfx/dma2d_bitblt.h>
 #include <io/display.h>
 #include <io/usb.h>
 #include <io/usb_hid.h>
@@ -762,6 +763,67 @@ __attribute((no_stack_protector)) void syscall_handler(uint32_t *args,
     }
 #endif  // USE_HW_JPEG_DECODER
 
+#ifdef USE_DMA2D
+    case SYSCALL_DMA2D_WAIT: {
+      dma2d_wait();
+    } break;
+
+    case SYSCALL_DMA2D_RGB565_FILL: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgb565_fill__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGB565_COPY_MONO4: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgb565_copy_mono4__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGB565_COPY_RGB565: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgb565_copy_rgb565__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGB565_BLEND_MONO4: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgb565_blend_mono4__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGB565_BLEND_MONO8: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgb565_blend_mono8__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGBA8888_FILL: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgba8888_fill__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGBA8888_COPY_MONO4: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgba8888_copy_mono4__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGBA8888_COPY_RGB565: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgba8888_copy_rgb565__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGBA8888_COPY_RGBA8888: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgba8888_copy_rgba8888__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGBA8888_BLEND_MONO4: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgba8888_blend_mono4__verified(bb);
+    } break;
+
+    case SYSCALL_DMA2D_RGBA8888_BLEND_MONO8: {
+      const gfx_bitblt_t *bb = (const gfx_bitblt_t *)args[0];
+      args[0] = dma2d_rgba8888_blend_mono8__verified(bb);
+    } break;
+#endif  // USE_DMA2D
+
     default:
       system_exit_fatal("Invalid syscall", __FILE__, __LINE__);
       break;

core/embed/sys/syscall/stm32/syscall_numbers.h

@@ -156,4 +156,17 @@ typedef enum {
   SYSCALL_JPEGDEC_GET_INFO,
   SYSCALL_JPEGDEC_GET_SLICE_RGBA8888,
 
+  SYSCALL_DMA2D_WAIT,
+  SYSCALL_DMA2D_RGB565_FILL,
+  SYSCALL_DMA2D_RGB565_COPY_MONO4,
+  SYSCALL_DMA2D_RGB565_COPY_RGB565,
+  SYSCALL_DMA2D_RGB565_BLEND_MONO4,
+  SYSCALL_DMA2D_RGB565_BLEND_MONO8,
+  SYSCALL_DMA2D_RGBA8888_FILL,
+  SYSCALL_DMA2D_RGBA8888_COPY_MONO4,
+  SYSCALL_DMA2D_RGBA8888_COPY_RGB565,
+  SYSCALL_DMA2D_RGBA8888_COPY_RGBA8888,
+  SYSCALL_DMA2D_RGBA8888_BLEND_MONO4,
+  SYSCALL_DMA2D_RGBA8888_BLEND_MONO8,
+
 } syscall_number_t;

core/embed/sys/syscall/stm32/syscall_probe.c

@@ -55,6 +55,12 @@ bool probe_read_access(const void *addr, size_t len) {
     return true;
   }
 
+#ifdef FRAMEBUFFER
+  if (mpu_inside_active_fb(addr, len)) {
+    return true;
+  }
+#endif
+
   if (inside_area(addr, len, &applet->layout.code1)) {
     return true;
   }
@@ -99,6 +105,12 @@ bool probe_write_access(void *addr, size_t len) {
     return true;
   }
 
+#ifdef FRAMEBUFFER
+  if (mpu_inside_active_fb(addr, len)) {
+    return true;
+  }
+#endif
+
   return false;
 }
 

core/embed/sys/syscall/stm32/syscall_stubs.c

@@ -705,15 +705,7 @@ bool powerctl_get_status(powerctl_status_t *status) {
 
 bool jpegdec_open(void) { return (bool)syscall_invoke0(SYSCALL_JPEGDEC_OPEN); }
 
-void jpegdec_close(void) {
+void jpegdec_close(void) { syscall_invoke0(SYSCALL_JPEGDEC_CLOSE); }
-  {
-    // Temporary hack to fix the problem with dual DMA2D driver in
-    // user/kernel space - will be removed in the future with DMA2D syscalls
-    extern void dma2d_invalidate_clut();
-    dma2d_invalidate_clut();
-  }
-  syscall_invoke0(SYSCALL_JPEGDEC_CLOSE);
-}
 
 jpegdec_state_t jpegdec_process(jpegdec_input_t *input) {
   return (jpegdec_state_t)syscall_invoke1((uint32_t)input,
@@ -731,4 +723,64 @@ bool jpegdec_get_slice_rgba8888(uint32_t *rgba8888, jpegdec_slice_t *slice) {
 
 #endif  // USE_HW_JPEG_DECODER
 
+// =============================================================================
+// gfx_bitblt.h
+// =============================================================================
+
+#ifdef USE_DMA2D
+
+#include <gfx/dma2d_bitblt.h>
+
+void dma2d_wait(void) { syscall_invoke0(SYSCALL_DMA2D_WAIT); }
+
+bool dma2d_rgb565_fill(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb, SYSCALL_DMA2D_RGB565_FILL);
+}
+
+bool dma2d_rgb565_copy_mono4(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb, SYSCALL_DMA2D_RGB565_COPY_MONO4);
+}
+
+bool dma2d_rgb565_copy_rgb565(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb, SYSCALL_DMA2D_RGB565_COPY_RGB565);
+}
+
+bool dma2d_rgb565_blend_mono4(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb, SYSCALL_DMA2D_RGB565_BLEND_MONO4);
+}
+
+bool dma2d_rgb565_blend_mono8(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb, SYSCALL_DMA2D_RGB565_BLEND_MONO8);
+}
+
+bool dma2d_rgba8888_fill(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb, SYSCALL_DMA2D_RGBA8888_FILL);
+}
+
+bool dma2d_rgba8888_copy_mono4(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb, SYSCALL_DMA2D_RGBA8888_COPY_MONO4);
+}
+
+bool dma2d_rgba8888_copy_rgb565(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb,
+                               SYSCALL_DMA2D_RGBA8888_COPY_RGB565);
+}
+
+bool dma2d_rgba8888_copy_rgba8888(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb,
+                               SYSCALL_DMA2D_RGBA8888_COPY_RGBA8888);
+}
+
+bool dma2d_rgba8888_blend_mono4(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb,
+                               SYSCALL_DMA2D_RGBA8888_BLEND_MONO4);
+}
+
+bool dma2d_rgba8888_blend_mono8(const gfx_bitblt_t *bb) {
+  return (bool)syscall_invoke1((uint32_t)bb,
+                               SYSCALL_DMA2D_RGBA8888_BLEND_MONO8);
+}
+
+#endif  // USE_DMA2D
+
 #endif  // KERNEL_MODE

core/embed/sys/syscall/stm32/syscall_verifiers.c

@@ -26,6 +26,19 @@
 
 #ifdef SYSCALL_DISPATCH
 
+// Checks if bitblt destination is accessible
+#define CHECK_BB_DST(_bb)                                       \
+  if (!probe_write_access((_bb)->dst_row,                       \
+                          (_bb)->dst_stride * (_bb)->height)) { \
+    goto access_violation;                                      \
+  }
+
+// Checks if bitblt source is accessible
+#define CHECK_BB_SRC(_bb)                                                      \
+  if (!probe_read_access((_bb)->src_row, (_bb)->src_stride * (_bb)->height)) { \
+    goto access_violation;                                                     \
+  }
+
 // ---------------------------------------------------------------------
 
 void system_exit__verified(int exit_code) {
@@ -176,15 +189,9 @@ void display_copy_rgb565__verified(const gfx_bitblt_t *bb) {
 
   gfx_bitblt_t bb_copy = *bb;
 
-  uint8_t *src_ptr = (uint8_t *)bb_copy.src_row;
+  CHECK_BB_SRC(&bb_copy);
-  size_t src_len = bb_copy.src_stride * bb_copy.height;
-
-  if (!probe_read_access(src_ptr, src_len)) {
-    goto access_violation;
-  }
 
   display_copy_rgb565(&bb_copy);
-
   return;
 
 access_violation:
@@ -850,4 +857,193 @@ access_violation:
 
 #endif  // USE_HW_JPEG_DECODER
 
+#ifdef USE_DMA2D
+
+bool dma2d_rgb565_fill__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+
+  return dma2d_rgb565_fill(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgb565_copy_mono4__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+  CHECK_BB_SRC(&bb_copy);
+
+  return dma2d_rgb565_copy_mono4(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgb565_copy_rgb565__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+  CHECK_BB_SRC(&bb_copy);
+
+  return dma2d_rgb565_copy_rgb565(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgb565_blend_mono4__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+  CHECK_BB_SRC(&bb_copy);
+
+  return dma2d_rgb565_blend_mono4(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgb565_blend_mono8__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+  CHECK_BB_SRC(&bb_copy);
+
+  return dma2d_rgb565_blend_mono8(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgba8888_fill__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+
+  return dma2d_rgba8888_fill(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgba8888_copy_mono4__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+  CHECK_BB_SRC(&bb_copy);
+
+  return dma2d_rgba8888_copy_mono4(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgba8888_copy_rgb565__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+  CHECK_BB_SRC(&bb_copy);
+
+  return dma2d_rgba8888_copy_rgb565(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgba8888_copy_rgba8888__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+  CHECK_BB_SRC(&bb_copy);
+
+  return dma2d_rgba8888_copy_rgba8888(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgba8888_blend_mono4__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+  CHECK_BB_SRC(&bb_copy);
+
+  return dma2d_rgba8888_blend_mono4(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+bool dma2d_rgba8888_blend_mono8__verified(const gfx_bitblt_t *bb) {
+  if (!probe_read_access(bb, sizeof(*bb))) {
+    goto access_violation;
+  }
+
+  gfx_bitblt_t bb_copy = *bb;
+
+  CHECK_BB_DST(&bb_copy);
+  CHECK_BB_SRC(&bb_copy);
+
+  return dma2d_rgba8888_blend_mono8(&bb_copy);
+
+access_violation:
+  apptask_access_violation();
+  return false;
+}
+
+#endif
+
 #endif  // SYSCALL_DISPATCH

core/embed/sys/syscall/stm32/syscall_verifiers.h

@@ -226,4 +226,33 @@ bool jpegdec_get_slice_rgba8888__verified(void *rgba8888,
 
 #endif  // USE_HW_JPEG_DECODER
 
+// ---------------------------------------------------------------------
+#ifdef USE_DMA2D
+
+#include <gfx/dma2d_bitblt.h>
+
+bool dma2d_rgb565_fill__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgb565_copy_mono4__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgb565_copy_rgb565__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgb565_blend_mono4__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgb565_blend_mono8__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgba8888_fill__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgba8888_copy_mono4__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgba8888_copy_rgb565__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgba8888_copy_rgba8888__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgba8888_blend_mono4__verified(const gfx_bitblt_t *bb);
+
+bool dma2d_rgba8888_blend_mono8__verified(const gfx_bitblt_t *bb);
+
+#endif
+
 #endif  // SYSCALL_DISPATCH

core/embed/sys/trustzone/inc/sys/trustzone.h

@@ -55,9 +55,6 @@ void tz_set_saes_unpriv(bool unpriv);
 // Sets unprivileged access to the TAMP peripheral.
 void tz_set_tamper_unpriv(bool unpriv);
 
-// Sets unprivileged access to the DMA2D peripheral.
-void tz_set_dma2d_unpriv(bool unpriv);
-
 // Sets unprivileged access to the GFXMMU peripheral.
 void tz_set_gfxmmu_unpriv(bool unpriv);
 

core/embed/sys/trustzone/stm32u5/trustzone.c

@@ -349,12 +349,6 @@ void tz_set_tamper_unpriv(bool unpriv) {
       unpriv ? GTZC_TZSC_PERIPH_NPRIV : GTZC_TZSC_PERIPH_PRIV);
 }
 
-void tz_set_dma2d_unpriv(bool unpriv) {
-  HAL_GTZC_TZSC_ConfigPeriphAttributes(
-      GTZC_PERIPH_DMA2D,
-      unpriv ? GTZC_TZSC_PERIPH_NPRIV : GTZC_TZSC_PERIPH_PRIV);
-}
-
 #if defined STM32U5A9xx || defined STM32U5G9xx
 void tz_set_gfxmmu_unpriv(bool unpriv) {
   HAL_GTZC_TZSC_ConfigPeriphAttributes(