feat(core): QA build for testing bootloaders / upgrades

[no changelog]

core/Makefile

@@ -166,7 +166,7 @@ build_boardloader: ## build boardloader
 	$(SCONS) CFLAGS="$(CFLAGS)" PRODUCTION="$(PRODUCTION)" TREZOR_MODEL="$(TREZOR_MODEL)" CMAKELISTS="$(CMAKELISTS)" $(BOARDLOADER_BUILD_DIR)/boardloader.bin
 
 build_bootloader: ## build bootloader
-	$(SCONS) CFLAGS="$(CFLAGS)" PRODUCTION="$(PRODUCTION)" TREZOR_MODEL="$(TREZOR_MODEL)" CMAKELISTS="$(CMAKELISTS)" $(BOOTLOADER_BUILD_DIR)/bootloader.bin
+	$(SCONS) CFLAGS="$(CFLAGS)" PRODUCTION="$(PRODUCTION)" TREZOR_MODEL="$(TREZOR_MODEL)" CMAKELISTS="$(CMAKELISTS)" BOOTLOADER_QA="$(BOOTLOADER_QA)" $(BOOTLOADER_BUILD_DIR)/bootloader.bin
 
 build_bootloader_ci: ## build CI device testing bootloader
 	$(SCONS) CFLAGS="$(CFLAGS)" PRODUCTION="$(PRODUCTION)" TREZOR_MODEL="$(TREZOR_MODEL)" CMAKELISTS="$(CMAKELISTS)" $(BOOTLOADER_CI_BUILD_DIR)/bootloader.bin

core/SConscript.bootloader

@@ -5,6 +5,8 @@ import tools
 
 TREZOR_MODEL = ARGUMENTS.get('TREZOR_MODEL', 'T')
 CMAKELISTS = int(ARGUMENTS.get('CMAKELISTS', 0))
+BOOTLOADER_QA = ARGUMENTS.get('BOOTLOADER_QA', '0') == '1'
+PRODUCTION = 0 if BOOTLOADER_QA else ARGUMENTS.get('PRODUCTION', '0') == '1'
 DMA2D = False
 
 if TREZOR_MODEL in ('1', ):
@@ -153,8 +155,7 @@ tools.add_font('BOLD', FONT_BOLD, CPPDEFINES_MOD, SOURCE_MOD)
 tools.add_font('DEMIBOLD', FONT_DEMIBOLD, CPPDEFINES_MOD, SOURCE_MOD)
 tools.add_font('MONO', FONT_MONO, CPPDEFINES_MOD, SOURCE_MOD)
 
-
+env = Environment(ENV=os.environ, CFLAGS=f"{ARGUMENTS.get('CFLAGS', '')} -DPRODUCTION={int(PRODUCTION)} -DBOOTLOADER_QA={int(BOOTLOADER_QA)}")
-env = Environment(ENV=os.environ, CFLAGS='%s -DPRODUCTION=%s' % (ARGUMENTS.get('CFLAGS', ''), ARGUMENTS.get('PRODUCTION', '0')))
 
 FEATURES_AVAILABLE = tools.configure_board(TREZOR_MODEL, FEATURES_WANTED, env, CPPDEFINES_MOD, SOURCE_TREZORHAL)
 
@@ -229,7 +230,7 @@ env.Replace(
 
 env.Replace(
     ALLSOURCES=SOURCE_MOD + SOURCE_BOOTLOADER + SOURCE_NANOPB + SOURCE_STMHAL + SOURCE_TREZORHAL,
-    ALLDEFS=tools.get_defs_for_cmake(env['CPPDEFINES']))
+    ALLDEFS=tools.get_defs_for_cmake(env['CPPDEFINES'] + [f"PRODUCTION={int(PRODUCTION)}", f"BOOTLOADER_QA={int(BOOTLOADER_QA)}"]))
 
 cmake_gen = env.Command(
     target='CMakeLists.txt',
@@ -303,7 +304,9 @@ program_elf = env.Command(
 
 env.Depends(program_elf, rust)
 
-BINARY_NAME = f"build/bootloader/bootloader-{tools.get_model_identifier(TREZOR_MODEL)}"
+SUFFIX = '_qa' if BOOTLOADER_QA else ''
+
+BINARY_NAME = f"build/bootloader/bootloader-{tools.get_model_identifier(TREZOR_MODEL)}{SUFFIX}"
 BINARY_NAME += "-" + tools.get_version('embed/bootloader/version.h')
 BINARY_NAME += "-" + tools.get_git_revision_short_hash()
 BINARY_NAME += "-dirty" if tools.get_git_modified() else ""
@@ -317,6 +320,6 @@ program_bin = env.Command(
     source=program_elf,
     action=[
         '$OBJCOPY -O binary -j .header -j .flash -j .data $SOURCE $TARGET',
-        '$HEADERTOOL $TARGET ' + ('-D' if ARGUMENTS.get('PRODUCTION', '0') == '0' else ''),
+        '$HEADERTOOL $TARGET ' + ('-D' if not PRODUCTION else ''),
         '$CP $TARGET ' + BINARY_NAME,
     ], )

core/SConscript.firmware

@@ -5,15 +5,13 @@ import os
 import tools
 
 BITCOIN_ONLY = ARGUMENTS.get('BITCOIN_ONLY', '0')
-PRODUCTION = ARGUMENTS.get('PRODUCTION', '0')
+PRODUCTION = ARGUMENTS.get('PRODUCTION', '0') == '1'
 BOOTLOADER_QA = ARGUMENTS.get('BOOTLOADER_QA', '0') == '1'
 EVERYTHING = BITCOIN_ONLY != '1'
 TREZOR_MODEL = ARGUMENTS.get('TREZOR_MODEL', 'T')
 DMA2D = TREZOR_MODEL in ('T', )
 CMAKELISTS = int(ARGUMENTS.get('CMAKELISTS', 0))
 
-if PRODUCTION != '1' and BOOTLOADER_QA:
-    raise ValueError('Firmware variant for bootloader upgrade testing must be done with PRODUCTION=1')
 
 FEATURE_FLAGS = {
     "RDI": True,
@@ -428,7 +426,7 @@ tools.add_font('MONO', FONT_MONO, CPPDEFINES_MOD, SOURCE_MOD)
 
 SOURCE_QSTR = SOURCE_MOD + SOURCE_MICROPYTHON + SOURCE_MICROPYTHON_SPEED
 
-env = Environment(ENV=os.environ, CFLAGS='%s -DPRODUCTION=%s -DPYOPT=%s -DBITCOIN_ONLY=%s' % (ARGUMENTS.get('CFLAGS', ''), PRODUCTION, PYOPT, BITCOIN_ONLY))
+env = Environment(ENV=os.environ, CFLAGS=f"{ARGUMENTS.get('CFLAGS', '')} -DPRODUCTION={int(PRODUCTION)} -DPYOPT={PYOPT} -DBOOTLOADER_QA={int(BOOTLOADER_QA)} -DBITCOIN_ONLY={BITCOIN_ONLY}")
 
 FEATURES_AVAILABLE = tools.configure_board(TREZOR_MODEL, FEATURES_WANTED, env, CPPDEFINES_MOD, SOURCE_TREZORHAL)
 
@@ -765,7 +763,7 @@ if FROZEN:
 
 env.Replace(
     ALLSOURCES=source_files,
-    ALLDEFS=tools.get_defs_for_cmake(env['CPPDEFINES']))
+    ALLDEFS=tools.get_defs_for_cmake(env['CPPDEFINES'] + [f"PRODUCTION={int(PRODUCTION)}", f"BOOTLOADER_QA={int(BOOTLOADER_QA)}", f"PYOPT={PYOPT}", f"BITCOIN_ONLY={BITCOIN_ONLY}"]))
 
 
 cmake_gen = env.Command(
@@ -775,7 +773,16 @@ cmake_gen = env.Command(
 )
 
 
-VENDORHEADER = 'embed/vendorheader/vendorheader_' + ('unsafe_signed_prod.bin' if ARGUMENTS.get('PRODUCTION', '0') == '0' else 'satoshilabs_signed_prod.bin')
+MODEL_IDENTIFIER = tools.get_model_identifier(TREZOR_MODEL)
+if BOOTLOADER_QA:
+    VENDORHEADER = 'embed/vendorheader/vendorheader_qa_DO_NOT_SIGN_signed_dev.bin'
+    BOOTLOADER_SUFFIX = MODEL_IDENTIFIER + '_qa'
+elif PRODUCTION:
+    VENDORHEADER = 'embed/vendorheader/vendorheader_satoshilabs_signed_prod.bin'
+    BOOTLOADER_SUFFIX = MODEL_IDENTIFIER
+else:
+    VENDORHEADER = 'embed/vendorheader/vendorheader_unsafe_signed_prod.bin'
+    BOOTLOADER_SUFFIX = MODEL_IDENTIFIER
 
 obj_program.extend(
     env.Command(
@@ -785,9 +792,6 @@ obj_program.extend(
         ' --rename-section .data=.vendorheader,alloc,load,readonly,contents'
         ' $SOURCE $TARGET', ))
 
-
-BOOTLOADER_SUFFIX =  tools.get_model_identifier(TREZOR_MODEL) + ('_QA' if BOOTLOADER_QA else '')
-
 obj_program.extend(
     env.Command(
         target='embed/firmware/bootloaders/bootloader.o',
@@ -826,7 +830,7 @@ if TREZOR_MODEL in ('T', 'R'):
         '$OBJCOPY -O binary -j .vendorheader -j .header -j .flash -j .data --pad-to 0x08100000 $SOURCE ${TARGET}.p1',
         '$OBJCOPY -O binary -j .flash2 $SOURCE ${TARGET}.p2',
         '$CAT ${TARGET}.p1 ${TARGET}.p2 > $TARGET',
-        '$HEADERTOOL -h $TARGET ' + ('-D' if ARGUMENTS.get('PRODUCTION', '0') == '0' else ''),
+        '$HEADERTOOL -h $TARGET ' + ('-D' if not PRODUCTION else ''),
         '$DD if=$TARGET of=${TARGET}.p1 skip=0 bs=128k count=6',
         '$CP $TARGET ' + BINARY_NAME,
     ]

core/embed/bootloader/main.c

@@ -56,13 +56,16 @@
 const uint8_t BOOTLOADER_KEY_M = 2;
 const uint8_t BOOTLOADER_KEY_N = 3;
 static const uint8_t * const BOOTLOADER_KEYS[] = {
+#if !BOOTLOADER_QA
     (const uint8_t *)"\xc2\xc8\x7a\x49\xc5\xa3\x46\x09\x77\xfb\xb2\xec\x9d\xfe\x60\xf0\x6b\xd6\x94\xdb\x82\x44\xbd\x49\x81\xfe\x3b\x7a\x26\x30\x7f\x3f",
     (const uint8_t *)"\x80\xd0\x36\xb0\x87\x39\xb8\x46\xf4\xcb\x77\x59\x30\x78\xde\xb2\x5d\xc9\x48\x7a\xed\xcf\x52\xe3\x0b\x4f\xb7\xcd\x70\x24\x17\x8a",
     (const uint8_t *)"\xb8\x30\x7a\x71\xf5\x52\xc6\x0a\x4c\xbb\x31\x7f\xf4\x8b\x82\xcd\xbf\x6b\x6b\xb5\xf0\x4c\x92\x0f\xec\x7b\xad\xf0\x17\x88\x37\x51",
+#else
 // comment the lines above and uncomment the lines below to use a custom signed vendorheader
-//    (const uint8_t *)"\xd7\x59\x79\x3b\xbc\x13\xa2\x81\x9a\x82\x7c\x76\xad\xb6\xfb\xa8\xa4\x9a\xee\x00\x7f\x49\xf2\xd0\x99\x2d\x99\xb8\x25\xad\x2c\x48",
+    (const uint8_t *)"\xd7\x59\x79\x3b\xbc\x13\xa2\x81\x9a\x82\x7c\x76\xad\xb6\xfb\xa8\xa4\x9a\xee\x00\x7f\x49\xf2\xd0\x99\x2d\x99\xb8\x25\xad\x2c\x48",
-//    (const uint8_t *)"\x63\x55\x69\x1c\x17\x8a\x8f\xf9\x10\x07\xa7\x47\x8a\xfb\x95\x5e\xf7\x35\x2c\x63\xe7\xb2\x57\x03\x98\x4c\xf7\x8b\x26\xe2\x1a\x56",
+    (const uint8_t *)"\x63\x55\x69\x1c\x17\x8a\x8f\xf9\x10\x07\xa7\x47\x8a\xfb\x95\x5e\xf7\x35\x2c\x63\xe7\xb2\x57\x03\x98\x4c\xf7\x8b\x26\xe2\x1a\x56",
-//    (const uint8_t *)"\xee\x93\xa4\xf6\x6f\x8d\x16\xb8\x19\xbb\x9b\xeb\x9f\xfc\xcd\xfc\xdc\x14\x12\xe8\x7f\xee\x6a\x32\x4c\x2a\x99\xa1\xe0\xe6\x71\x48",
+    (const uint8_t *)"\xee\x93\xa4\xf6\x6f\x8d\x16\xb8\x19\xbb\x9b\xeb\x9f\xfc\xcd\xfc\xdc\x14\x12\xe8\x7f\xee\x6a\x32\x4c\x2a\x99\xa1\xe0\xe6\x71\x48",
+#endif
 };
 
 #define USB_IFACE_NUM 0

core/embed/firmware/bl_check.c

@@ -59,26 +59,65 @@ static secbool known_bootloader(const uint8_t *hash, int len) {
 }
 */
 
+// clang-format off
+// --- BEGIN GENERATED BOOTLOADER SECTION ---
+// bootloader_T1B1.bin version <unknown>
+#define BOOTLOADER_T1B1_00 {0xc1, 0x01, 0xd3, 0x8a, 0x00, 0x5e, 0x4f, 0x5f, 0x87, 0x1f, 0x49, 0x78, 0x24, 0x9c, 0xf9, 0x82, 0xd1, 0x91, 0x4b, 0xa6, 0x90, 0x03, 0x9c, 0x50, 0x49, 0x61, 0x10, 0x4f, 0xee, 0xe7, 0x1d, 0x7b}
+#define BOOTLOADER_T1B1_FF {0xbd, 0xb2, 0xf7, 0x62, 0xfb, 0x10, 0xbb, 0x30, 0x1f, 0x95, 0xa3, 0x12, 0x6b, 0x41, 0x1f, 0x66, 0xfc, 0x57, 0x28, 0xce, 0x7f, 0x59, 0x42, 0x6c, 0x3e, 0xed, 0xf7, 0x69, 0xbb, 0x96, 0xbd, 0x4b}
+// bootloader_T2T1.bin version 2.0.3.0
+#define BOOTLOADER_T2T1_00 {0xb1, 0x83, 0xd3, 0x31, 0xc7, 0xff, 0x3d, 0xcf, 0x54, 0x1e, 0x7e, 0x40, 0xf4, 0x9e, 0xc3, 0x53, 0x4c, 0xcc, 0xf3, 0x8c, 0x35, 0x39, 0x88, 0x81, 0x65, 0xc0, 0x5c, 0x25, 0xbd, 0xfc, 0xea, 0x14}
+#define BOOTLOADER_T2T1_FF {0xab, 0xdb, 0x7d, 0xe2, 0xef, 0x44, 0x66, 0xa7, 0xb7, 0x1f, 0x2b, 0x02, 0xf3, 0xe1, 0x40, 0xe7, 0xcd, 0xf2, 0x8e, 0xc0, 0xbb, 0x33, 0x04, 0xce, 0x0d, 0xa5, 0xca, 0x02, 0x57, 0xb6, 0xd4, 0x30}
+// bootloader_T2T1_qa.bin version 2.1.0.0
+#define BOOTLOADER_T2T1_QA_00 {0x61, 0xae, 0x70, 0xd3, 0xf9, 0x13, 0x4f, 0x79, 0x99, 0xd1, 0x5d, 0x3e, 0x68, 0xd6, 0x27, 0x96, 0x16, 0x85, 0xc6, 0x8e, 0x80, 0x7e, 0xae, 0x36, 0xaa, 0x5f, 0x2f, 0xa4, 0xb4, 0x59, 0x04, 0x2e}
+#define BOOTLOADER_T2T1_QA_FF {0xe4, 0x52, 0x96, 0x96, 0x40, 0x03, 0xa0, 0xb5, 0x91, 0x2d, 0xe3, 0x11, 0x65, 0xd3, 0xb8, 0x92, 0x2e, 0x87, 0x41, 0xab, 0xe8, 0x94, 0x62, 0x2e, 0x41, 0x1f, 0x0b, 0x47, 0xe2, 0x8c, 0x83, 0xaa}
+// bootloader_1.bin version <unknown>
+#define BOOTLOADER_1_00 {0xa5, 0x5a, 0x8b, 0x88, 0x94, 0x8a, 0x33, 0x2b, 0xed, 0x0d, 0xd9, 0x5c, 0x79, 0xd5, 0xbe, 0x0c, 0x73, 0x52, 0xaa, 0xac, 0xb3, 0x4f, 0xea, 0xd0, 0xaa, 0x88, 0x33, 0x23, 0x64, 0xab, 0x77, 0x5a}
+#define BOOTLOADER_1_FF {0x50, 0x6c, 0x5f, 0xd3, 0x73, 0x7b, 0x9b, 0xb7, 0xb9, 0xbf, 0xf9, 0xfa, 0xc6, 0xb9, 0x43, 0x27, 0x8b, 0x06, 0xad, 0x3a, 0xec, 0xce, 0x35, 0xa3, 0x52, 0xc3, 0x6e, 0x9e, 0x9a, 0xb3, 0x50, 0x98}
+// bootloader_T2B1.bin version 2.0.5.0
+#define BOOTLOADER_T2B1_00 {0xf1, 0x3d, 0x46, 0x21, 0xec, 0xf9, 0x92, 0xfb, 0x5c, 0x50, 0xaf, 0xdb, 0x55, 0x13, 0x0e, 0x7f, 0xbe, 0x5b, 0x30, 0x37, 0xc9, 0x17, 0xff, 0xf5, 0xe7, 0xd7, 0xe9, 0x1d, 0x09, 0x5c, 0xf3, 0x2a}
+#define BOOTLOADER_T2B1_FF {0xa9, 0xf0, 0x63, 0xfd, 0x8a, 0xe7, 0x6c, 0x52, 0x92, 0xcb, 0x11, 0x69, 0x87, 0x79, 0x62, 0x11, 0x1e, 0x01, 0x1e, 0xf1, 0xb5, 0xd9, 0x20, 0x16, 0x4d, 0x2c, 0x16, 0x41, 0x0d, 0xa1, 0xe7, 0xc8}
+// --- END GENERATED BOOTLOADER SECTION ---
+
+#if defined TREZOR_MODEL_T
+  #if BOOTLOADER_QA
+    // QA bootloaders for T2T1
+    #define BOOTLOADER_00 BOOTLOADER_T2T1_QA_00
+    #define BOOTLOADER_FF BOOTLOADER_T2T1_QA_FF
+  #else
+    // normal bootloaders for T2T1
+    #define BOOTLOADER_00 BOOTLOADER_T2T1_00
+    #define BOOTLOADER_FF BOOTLOADER_T2T1_FF
+  #endif
+#elif defined TREZOR_MODEL_R
+  #if BOOTLOADER_QA
+    // QA bootloaders for T2R1
+    #define BOOTLOADER_00 BOOTLOADER_T2B1_QA_00
+    #define BOOTLOADER_FF BOOTLOADER_T2B1_QA_FF
+  #else
+    // normal bootloaders for T2R1
+    #define BOOTLOADER_00 BOOTLOADER_T2B1_00
+    #define BOOTLOADER_FF BOOTLOADER_T2B1_FF
+  #endif
+#else
+  #error "Cannot select bootloader hashes for unknown model."
+#endif
+// clang-format on
+
+#if PRODUCTION || BOOTLOADER_QA
 static secbool latest_bootloader(const uint8_t *hash, int len) {
   if (len != 32) return secfalse;
-  // bootloader.bin (padded with 0x00)
+
-  if (0 ==
+  uint8_t hash_00[] = BOOTLOADER_00;
-      memcmp(hash,
+  uint8_t hash_FF[] = BOOTLOADER_FF;
-             "\xb1\x83\xd3\x31\xc7\xff\x3d\xcf\x54\x1e\x7e\x40\xf4\x9e\xc3\x53"
+
-             "\x4c\xcc\xf3\x8c\x35\x39\x88\x81\x65\xc0\x5c\x25\xbd\xfc\xea\x14",
+  if (0 == memcmp(hash, hash_00, 32)) return sectrue;
-             32))
+  if (0 == memcmp(hash, hash_FF, 32)) return sectrue;
-    return sectrue;
-  // bootloader.bin (padded with 0xff)
-  if (0 ==
-      memcmp(hash,
-             "\xab\xdb\x7d\xe2\xef\x44\x66\xa7\xb7\x1f\x2b\x02\xf3\xe1\x40\xe7"
-             "\xcd\xf2\x8e\xc0\xbb\x33\x04\xce\x0d\xa5\xca\x02\x57\xb6\xd4\x30",
-             32))
-    return sectrue;
   return secfalse;
 }
+#endif
 
 void check_and_replace_bootloader(void) {
+#if PRODUCTION || BOOTLOADER_QA
   // compute current bootloader hash
   uint8_t hash[BLAKE2S_DIGEST_LENGTH];
   const uint32_t bl_len = 128 * 1024;
@@ -154,4 +193,5 @@ void check_and_replace_bootloader(void) {
            NULL);
   }
   ensure(flash_lock_write(), NULL);
+#endif
 }

core/embed/firmware/bootloader_hashes.py

@@ -1,23 +1,103 @@
 #!/usr/bin/env python3
-import glob
+from pathlib import Path
-try:
 from hashlib import blake2s
-except ImportError:
+
-    from pyblake2 import blake2s
+from trezorlib.firmware.core import FirmwareImage
 
 ALIGNED_SIZE = 128 * 1024
 
-files = glob.glob("bootloader*.bin")
+HERE = Path(__file__).parent
+BOOTLOADERS = HERE / "bootloaders"
 
-for fn in sorted(files):
+BL_CHECK = HERE / "bl_check.c"
-    data = open(fn, "rb").read()
+
+BL_CHECK_AUTO_BEGIN = "// --- BEGIN GENERATED BOOTLOADER SECTION ---\n"
+BL_CHECK_AUTO_END = "// --- END GENERATED BOOTLOADER SECTION ---\n"
+
+PATTERN = """\
+// {name} version {version}
+#define BOOTLOADER_{suffix}_00 {{{bytes_00}}}
+#define BOOTLOADER_{suffix}_FF {{{bytes_ff}}}
+"""
+
+
+def aligned_digest(data: bytes, padding: bytes) -> bytes:
+    """Calculate digest of data, aligned to ALIGNED_SIZE with
+    the specified padding.
+
+    Firmware needs to check the bootloader against a digest padded either by 0xff
+    (unwritten NOR-flash byte) or 0x00 (explicitly cleared byte).
+    """
     if len(data) > ALIGNED_SIZE:
         raise ValueError(fn, "too big")
-    data_00 = data + b"\x00" * (ALIGNED_SIZE - len(data))
+
-    data_ff = data + b"\xff" * (ALIGNED_SIZE - len(data))
+    assert len(padding) == 1
-    h_00 = blake2s(data=data_00).digest()
+    digest_data = data + padding * (ALIGNED_SIZE - len(data))
-    h_ff = blake2s(data=data_ff).digest()
+    assert len(digest_data) == ALIGNED_SIZE
-    h_00 = "".join(["\\x%02x" % i for i in h_00])
+    return blake2s(digest_data).digest()
-    h_ff = "".join(["\\x%02x" % i for i in h_ff])
+
-    print("    // %s (padded with 0x00)\n    if (0 == memcmp(hash, \"%s\", 32)) return sectrue;" % (fn, h_00))
+
-    print("    // %s (padded with 0xff)\n    if (0 == memcmp(hash, \"%s\", 32)) return sectrue;" % (fn, h_ff))
+def to_uint_array(data: bytes) -> str:
+    """Convert bytes to C array of uint8_t, like so:
+
+    >>> to_uint_array(b"\\x00\\x01\\x02")
+    "{0x00, 0x01, 0x02}"
+    """
+    return ", ".join([f"0x{i:02x}" for i in data])
+
+
+def bootloader_str(file: Path) -> str:
+    """From a given file, generate the relevant C definition strings from PATTERN.
+
+    Calculates the two padded hashes, one with 0x00 and the other 0xFF, and returns
+    a string suitable for writing into bl_check.c.
+    """
+    data = file.read_bytes()
+
+    suffix = file.stem[len("bootloader_") :].upper()
+    bytes_00 = to_uint_array(aligned_digest(data, b"\x00"))
+    bytes_ff = to_uint_array(aligned_digest(data, b"\xff"))
+
+    try:
+        bl = FirmwareImage.parse(data)
+        version_str = ".".join(str(x) for x in bl.header.version)
+    except Exception:
+        version_str = "<unknown>"
+
+    return PATTERN.format(
+        name=file.name,
+        version=version_str,
+        suffix=suffix,
+        bytes_00=bytes_00,
+        bytes_ff=bytes_ff,
+    )
+
+
+def main():
+    bl_check_new = []
+    with open(BL_CHECK) as f:
+        # read up to auto-begin
+        for line in f:
+            bl_check_new.append(line)
+            if line == BL_CHECK_AUTO_BEGIN:
+                break
+
+        # write bootloader definitions
+        for file in BOOTLOADERS.glob("bootloader*.bin"):
+            bl_check_new.append(bootloader_str(file))
+
+        # consume up to auto-end
+        for line in f:
+            if line == BL_CHECK_AUTO_END:
+                bl_check_new.append(line)
+                break
+
+        # read the rest
+        bl_check_new.extend(f)
+
+    # write the file
+    BL_CHECK.write_text("".join(bl_check_new))
+
+
+if __name__ == "__main__":
+    main()

core/embed/firmware/main.c

@@ -96,7 +96,7 @@ int main(void) {
 #if !defined TREZOR_MODEL_1
   parse_boardloader_capabilities();
 
-#if PRODUCTION
+#if PRODUCTION || BOOTLOADER_QA
   check_and_replace_bootloader();
 #endif
   // Enable MPU

core/embed/firmware/memory_T.ld

@@ -45,6 +45,9 @@ SECTIONS {
 
   .flash2 : ALIGN(512) {
     build/firmware/frozen_mpy.o(.rodata*);
+    build/firmware/vendor/secp256k1-zkp/src/secp256k1.o(.rodata*);
+    build/firmware/vendor/secp256k1-zkp/src/precomputed_ecmult.o(.rodata*);
+    build/firmware/vendor/secp256k1-zkp/src/precomputed_ecmult_gen.o(.rodata*);
     build/firmware/vendor/trezor-crypto/aes/aestab.o(.rodata*);
     . = ALIGN(4);
     */libtrezor_lib.a:(.text*);

python/src/trezorlib/_internal/firmware_headers.py

@@ -337,7 +337,6 @@ class VendorFirmware(firmware.VendorFirmware, CosiSignedMixin):
         assert isinstance(vh, VendorHeader)
 
         is_devel = self.vendor_header.vhash() == VHASH_DEVEL
-
         return (
             vh._format(terse=not verbose)
             + "\n"

python/src/trezorlib/firmware/core.py

@@ -186,14 +186,9 @@ class VendorFirmware(Struct):
         return self.firmware.digest()
 
     def verify(self, dev_keys: bool = False) -> None:
-        if dev_keys:
-            raise ValueError(
-                "Cannot select dev keys for a vendor firmware; use development vendor header instead."
-            )
-
         self.firmware.validate_code_hashes()
 
-        self.vendor_header.verify()
+        self.vendor_header.verify(dev_keys)
         digest = self.digest()
         try:
             cosi.verify(

python/src/trezorlib/firmware/vendor.py

@@ -130,14 +130,16 @@ class VendorHeader(Struct):
         digest = self.digest()
         if not dev_keys:
             public_keys = TREZOR_T.bootloader_keys
+            sigs_needed = TREZOR_T.bootloader_sigs_needed
         else:
             public_keys = TREZOR_T_DEV.bootloader_keys
+            sigs_needed = TREZOR_T_DEV.bootloader_sigs_needed
         # TODO: add model awareness
         try:
             cosi.verify(
                 self.signature,
                 digest,
-                TREZOR_T.bootloader_sigs_needed,
+                sigs_needed,
                 public_keys,
                 self.sigmask,
             )