From c2c1591f5c92fa4adee5fe08ea7f1a6228deb33b Mon Sep 17 00:00:00 2001 From: Andrew Kozlik Date: Mon, 22 Apr 2024 10:32:23 +0200 Subject: [PATCH] chore(core): Improve VTRUST bits documentation and naming. [no changelog] --- core/embed/bootloader/bootui.c | 8 ++++---- core/embed/bootloader/main.c | 13 +++++++------ core/embed/bootloader/messages.c | 4 ++-- core/embed/lib/image.h | 21 +++++++++++++++------ docs/core/misc/boot.md | 10 +++++++++- 5 files changed, 37 insertions(+), 19 deletions(-) diff --git a/core/embed/bootloader/bootui.c b/core/embed/bootloader/bootui.c index ae570c84fc..f860c2296a 100644 --- a/core/embed/bootloader/bootui.c +++ b/core/embed/bootloader/bootui.c @@ -83,11 +83,11 @@ void ui_set_initial_setup(bool initial) { initial_setup = initial; } #ifndef NEW_RENDERING static void ui_screen_boot_old(const vendor_header *const vhdr, const image_header *const hdr) { - const int show_string = ((vhdr->vtrust & VTRUST_STRING) == 0); - if ((vhdr->vtrust & VTRUST_RED) == 0) { - boot_background = COLOR_BL_FAIL; - } else { + const int show_string = ((vhdr->vtrust & VTRUST_NO_STRING) == 0); + if ((vhdr->vtrust & VTRUST_NO_RED) != 0) { boot_background = COLOR_BLACK; + } else { + boot_background = COLOR_BL_FAIL; } const uint8_t *vimg = vhdr->vimg; diff --git a/core/embed/bootloader/main.c b/core/embed/bootloader/main.c index 159b9661ba..042c795516 100644 --- a/core/embed/bootloader/main.c +++ b/core/embed/bootloader/main.c @@ -325,16 +325,17 @@ void real_jump_to_firmware(void) { "Firmware is corrupted"); secret_prepare_fw( - ((vhdr.vtrust & VTRUST_SECRET) == VTRUST_SECRET_ALLOW) * sectrue, - ((vhdr.vtrust & VTRUST_ALL) == VTRUST_ALL) * sectrue); + ((vhdr.vtrust & VTRUST_SECRET_MASK) == VTRUST_SECRET_ALLOW) * sectrue, + ((vhdr.vtrust & VTRUST_NO_WARNING) == VTRUST_NO_WARNING) * sectrue); - // if all VTRUST flags are unset = ultimate trust => skip the procedure - if ((vhdr.vtrust & VTRUST_ALL) != VTRUST_ALL) { + // if all warnings are disabled in VTRUST flags then skip the procedure + if ((vhdr.vtrust & VTRUST_NO_WARNING) != VTRUST_NO_WARNING) { ui_fadeout(); ui_screen_boot(&vhdr, hdr, 0); ui_fadein(); - int delay = (vhdr.vtrust & VTRUST_WAIT) ^ VTRUST_WAIT; + // The delay is encoded in bitwise complement form. + int delay = (vhdr.vtrust & VTRUST_WAIT_MASK) ^ VTRUST_WAIT_MASK; if (delay > 1) { while (delay > 0) { ui_screen_boot(&vhdr, hdr, delay); @@ -345,7 +346,7 @@ void real_jump_to_firmware(void) { hal_delay(1000); } - if ((vhdr.vtrust & VTRUST_CLICK) == 0) { + if ((vhdr.vtrust & VTRUST_NO_CLICK) == 0) { ui_screen_boot(&vhdr, hdr, -1); ui_click(); } diff --git a/core/embed/bootloader/messages.c b/core/embed/bootloader/messages.c index 5b36003a07..89bc4e365b 100644 --- a/core/embed/bootloader/messages.c +++ b/core/embed/bootloader/messages.c @@ -626,7 +626,7 @@ int process_msg_FirmwareUpload(uint8_t iface_num, uint32_t msg_size, return UPLOAD_ERR_NOT_FIRMWARE_UPGRADE; } - if ((vhdr.vtrust & VTRUST_ALL) != VTRUST_ALL) { + if ((vhdr.vtrust & VTRUST_NO_WARNING) != VTRUST_NO_WARNING) { MSG_SEND_INIT(Failure); MSG_SEND_ASSIGN_VALUE(code, FailureType_Failure_ProcessError); MSG_SEND_ASSIGN_STRING(message, "Not a full-trust image"); @@ -640,7 +640,7 @@ int process_msg_FirmwareUpload(uint8_t iface_num, uint32_t msg_size, #if defined USE_OPTIGA && !defined STM32U5 if (sectrue != secret_wiped() && - ((vhdr.vtrust & VTRUST_SECRET) != VTRUST_SECRET_ALLOW)) { + ((vhdr.vtrust & VTRUST_SECRET_MASK) != VTRUST_SECRET_ALLOW)) { MSG_SEND_INIT(Failure); MSG_SEND_ASSIGN_VALUE(code, FailureType_Failure_ProcessError); MSG_SEND_ASSIGN_STRING(message, "Install restricted"); diff --git a/core/embed/lib/image.h b/core/embed/lib/image.h index bd4fc3508b..a385b54ee8 100644 --- a/core/embed/lib/image.h +++ b/core/embed/lib/image.h @@ -54,19 +54,28 @@ typedef struct { #define MAX_VENDOR_PUBLIC_KEYS 8 -#define VTRUST_WAIT 0x000F -#define VTRUST_RED 0x0010 -#define VTRUST_CLICK 0x0020 -#define VTRUST_STRING 0x0040 +// The mask of the vendor screen wait time in seconds, encoded in bitwise +// complement form. +#define VTRUST_WAIT_MASK 0x000F + +// Use black background instead of red one in the vendor screen. +#define VTRUST_NO_RED 0x0010 + +// Do not require user click to leave the vendor screen. +#define VTRUST_NO_CLICK 0x0020 + +// Do not show vendor string in the vendor screen. +#define VTRUST_NO_STRING 0x0040 // Two bits for historical reasons. On T2B1, only the lower bit was used with // inverted logic (due to late inclusion of the secret handling during // development process). On T3T1, we decided to remedy the situation by // including the upper bit as well. -#define VTRUST_SECRET 0x0180 +#define VTRUST_SECRET_MASK 0x0180 #define VTRUST_SECRET_ALLOW 0x0100 -#define VTRUST_ALL (VTRUST_WAIT | VTRUST_RED | VTRUST_CLICK | VTRUST_STRING) +#define VTRUST_NO_WARNING \ + (VTRUST_WAIT_MASK | VTRUST_NO_RED | VTRUST_NO_CLICK | VTRUST_NO_STRING) typedef struct { uint32_t magic; diff --git a/docs/core/misc/boot.md b/docs/core/misc/boot.md index 7f4de34886..45e504463c 100644 --- a/docs/core/misc/boot.md +++ b/docs/core/misc/boot.md @@ -139,8 +139,16 @@ Vendor trust is stored as bitmap where unset bit means the feature is active. | 2 | 0x0004 | wait 4 seconds | | 3 | 0x0008 | wait 8 seconds | | 4 | 0x0010 | use red background instead of black one | -| 5 | 0x0020 | require user click | +| 5 | 0x0020 | require user click to continue | | 6 | 0x0040 | show vendor string (not just the logo) | +| 7 | 0x0080 | allow access to pairing secret | +| 8 | 0x0100 | disable access to pairing secret | + +Bits 0 to 6 represent vendor screen settings. The wait times are additive. + +Two bits are used for access to the pairing secret for historical reasons. +On T2B1 only bit 7 is evaluated. +On newer models, both bits 7 and 8 are evaluated. ### Firmware Header