upgrade THD89 integration and improve bootloader and storage reliability

core/SConscript.bootloader

@@ -40,6 +40,7 @@ SOURCE_MOD += [
     'vendor/trezor-crypto/secp256k1.c',
     'vendor/trezor-crypto/memzero.c',
     'vendor/trezor-crypto/rand.c',
+    'vendor/trezor-crypto/hmac.c',
     'vendor/trezor-crypto/sha2.c',
     'vendor/trezor-crypto/aes/aes_modes.c',
     'vendor/trezor-crypto/aes/aescrypt.c',
@@ -178,6 +179,7 @@ SOURCE_TREZORHAL = [
     'embed/trezorhal/thd89.c',
     'embed/trezorhal/thd89_boot.c',
     'embed/trezorhal/se_thd89.c',
+    'embed/trezorhal/se_thd89_v2.c',
     'embed/trezorhal/util.s',
     'embed/trezorhal/vectortable.s',
     'embed/trezorhal/camera.c',

core/SConscript.firmware

@@ -495,6 +495,7 @@ if PRODUCTION_MODEL == 'H':
         'embed/trezorhal/usbd_ulpi.c',
         'embed/trezorhal/thd89.c',
         'embed/trezorhal/se_thd89.c',
+        'embed/trezorhal/se_thd89_v2.c',
 	    'embed/trezorhal/trans_fifo.c',
         'embed/trezorhal/usart.c',
         'embed/trezorhal/motor.c',

core/embed/bootloader/bootui.c

@@ -272,8 +272,10 @@ void ui_screen_install_confirm_newvendor_or_downgrade_wipe(char* new_version) {
   vendor_header current_vhdr;
   image_header current_hdr;
   // char str[128] = {0};
-  if (sectrue == load_vendor_header((const uint8_t*)FIRMWARE_START, FW_KEY_M,
-                                    FW_KEY_N, FW_KEYS, &current_vhdr)) {
+  if (sectrue ==
+      load_vendor_header((const uint8_t*)FIRMWARE_START,
+                         VENDOR_HEADER_MAX_SIZE, FW_KEY_M, FW_KEY_N, FW_KEYS,
+                         &current_vhdr)) {
     if (sectrue ==
         load_image_header((const uint8_t*)FIRMWARE_START + current_vhdr.hdrlen,
                           FIRMWARE_IMAGE_MAGIC, FIRMWARE_IMAGE_MAXSIZE,
@@ -365,6 +367,7 @@ static bool ui_progress_bar_visible = false;
 void ui_screen_progress_bar_init(char* title, char* notes, int progress) {
   ui_statusbar_update();
   ui_logo_onekey();
+  ui_progress_bar_visible = true;
   if (title != NULL) {
     display_text_center(DISPLAY_RESX / 2, TITLE_OFFSET_Y, title, -1,
                         FONT_PJKS_BOLD_38, COLOR_BL_FG, COLOR_BL_BG);
@@ -407,6 +410,8 @@ void ui_screen_progress_bar_update(char* title, char* notes, int progress) {
   }
 }
 
+bool ui_progress_bar_is_visible(void) { return ui_progress_bar_visible; }
+
 void ui_progress_bar_visible_clear(void) { ui_progress_bar_visible = false; }
 
 void ui_screen_install_start(void) {
@@ -541,6 +546,7 @@ void ui_screen_fail(void) {
 void ui_fadein(void) { display_fade(0, BACKLIGHT_NORMAL, 200); }
 
 void ui_fadeout(void) {
+  ui_progress_bar_visible_clear();
   display_fade(BACKLIGHT_NORMAL, 0, 200);
   display_clear();
 }
@@ -1041,6 +1047,21 @@ void ui_bootloader_first(const image_header* const hdr) {
   }
 }
 
+void ui_bootloader_se_version_required(const image_header* const hdr) {
+  ui_bootloader_first(hdr);
+  ui_logo_warning();
+  display_bar(0, SUBTITLE_OFFSET_Y - 10, DISPLAY_RESX, 150, COLOR_BL_BG);
+  display_text_center(DISPLAY_RESX / 2, SUBTITLE_OFFSET_Y,
+                      "SE firmware update required", -1, FONT_NORMAL,
+                      COLOR_BL_FG, COLOR_BL_BG);
+  display_text_center(DISPLAY_RESX / 2, SUBTITLE_OFFSET_Y + 36,
+                      "Version 1.3.2 or later is required", -1, FONT_NORMAL,
+                      COLOR_BL_SUBTITLE, COLOR_BL_BG);
+  display_text_center(DISPLAY_RESX / 2, SUBTITLE_OFFSET_Y + 72,
+                      "Install an SE firmware update", -1, FONT_NORMAL,
+                      COLOR_BL_SUBTITLE, COLOR_BL_BG);
+}
+
 void ui_bootloader_main_menu(const image_header* const hdr) {
   ui_bootloader_page_current = 5;
 

core/embed/bootloader/bootui.h

@@ -55,6 +55,7 @@ void ui_screen_confirm(char* title, char* note_l1, char* note_l2, char* note_l3,
 void ui_screen_progress_bar_init(char* title, char* notes, int progress);
 void ui_screen_progress_bar_prepare(char* title, char* notes);
 void ui_screen_progress_bar_update(char* msg_status, char* notes, int progress);
+bool ui_progress_bar_is_visible(void);
 void ui_progress_bar_visible_clear(void);
 
 void ui_screen_wipe_confirm(void);
@@ -92,6 +93,7 @@ int ui_input_poll(int zones, bool poll);
 int ui_input_match(int zones, uint32_t evt);
 void ui_bootloader_simple(void);
 void ui_bootloader_first(const image_header* const hdr);
+void ui_bootloader_se_version_required(const image_header* const hdr);
 void ui_bootloader_view_details(const image_header* const hdr);
 void ui_wipe_confirm(const image_header* const hdr);
 void ui_show_version_info(int y, char* current_ver, char* new_ver);

core/embed/bootloader/header.S

@@ -23,7 +23,15 @@ g_header:
     . = . + 8                        // reserved
     . = . + 512                      // hash1 ... hash16
     . = . + 399                      // reserved
-    .string  BUILD_COMMIT            // commit_id
+    // Keep this field aligned with image_header.build_id[16].
+g_build_id:
+    .string BUILD_COMMIT             // NUL-terminated commit ID
+g_build_id_end:
+    .if (g_build_id_end - g_build_id) > 16
+    .error "BUILD_COMMIT must be at most 15 characters"
+    .else
+    .fill 16 - (g_build_id_end - g_build_id), 1, 0
+    .endif
     .byte 0                          // sigmask
     . = . + 64                       // sig
 g_header_end:

core/embed/bootloader/main.c

@@ -17,6 +17,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <stdint.h>
 #include <string.h>
 #include <sys/types.h>
 
@@ -59,6 +60,10 @@
 
 #define MSG_NAME_TO_ID(x) MessageType_MessageType_##x
 
+#define REQUIRED_SE_VERSION_MAJOR 1
+#define REQUIRED_SE_VERSION_MINOR 3
+#define REQUIRED_SE_VERSION_PATCH 2
+
 #if defined(STM32H747xx)
 #include "stm32h7xx_hal.h"
 #endif
@@ -755,9 +760,15 @@ int main(void) {
   thd89_init();
 
   uint8_t se_mode = se_get_state();
-  // all se in app mode
+  secbool se_version_supported = sectrue;
+
   if (se_mode == 0) {
-    device_para_init();
+    se_version_supported = se_all_versions_at_least(
+        REQUIRED_SE_VERSION_MAJOR, REQUIRED_SE_VERSION_MINOR,
+        REQUIRED_SE_VERSION_PATCH);
+    if (se_version_supported == sectrue) {
+      device_para_init();
+    }
   }
 
   if ((!device_serial_set() || !se_has_cerrificate()) && se_mode == 0) {
@@ -812,18 +823,30 @@ int main(void) {
 
   BOOT_TARGET boot_target =
       decide_boot_target(&vhdr, &hdr, &vhdr_valid, &hdr_valid, &code_valid);
+  if (boot_target == BOOT_TARGET_NORMAL &&
+      se_version_supported != sectrue) {
+    boot_target = BOOT_TARGET_BOOTLOADER;
+  }
   // boot_target = BOOT_TARGET_BOOTLOADER;
 
   if (boot_target == BOOT_TARGET_BOOTLOADER) {
     display_clear();
 
     if (sectrue == vhdr_valid && sectrue == hdr_valid) {
-      ui_bootloader_first(&hdr);
+      if (se_version_supported == sectrue) {
+        ui_bootloader_first(&hdr);
+      } else {
+        ui_bootloader_se_version_required(&hdr);
+      }
       if (bootloader_usb_loop(&vhdr, &hdr) != sectrue) {
         return 1;
       }
     } else {
-      ui_bootloader_first(NULL);
+      if (se_version_supported == sectrue) {
+        ui_bootloader_first(NULL);
+      } else {
+        ui_bootloader_se_version_required(NULL);
+      }
       if (bootloader_usb_loop(NULL, NULL) != sectrue) {
         return 1;
       }

core/embed/bootloader/memory.ld

@@ -31,6 +31,8 @@ SECTIONS {
   .header : ALIGN(4) {
     KEEP(*(.header));
   } >FLASH AT>FLASH
+  ASSERT(SIZEOF(.header) == 0x400,
+         "bootloader header must be exactly 0x400 bytes")
 
   .flash : ALIGN(512) {
     KEEP(*(.vector_table));
@@ -51,7 +53,7 @@ SECTIONS {
   .padding : {
     KEEP(*(.padding));
     FILL(0xDEADBEEF); /* fill pattern */
-    . = LENGTH(FLASH) - SIZEOF(.header) - SIZEOF(.flash) - SIZEOF(.data) - 1 - 8;
+    . = LENGTH(FLASH) - SIZEOF(.header) - SIZEOF(.flash) - SIZEOF(.data) - 1;
     BYTE(0x00); /* needed to keep this section without references in .s or .c */
   } >FLASH AT>FLASH
 

core/embed/emmc_wrapper/emmc_commands.c

@@ -1,5 +1,6 @@
 #include "emmc_commands.h"
 #include "emmc_commands_macros.h"
+#include "emmc_ui_progress.h"
 
 #include "bootui.h"
 #include "fw_keys.h"
@@ -10,28 +11,30 @@
 // SDRAM BUFFER
 bootloader_buffer* bl_buffer = (bootloader_buffer*)FMC_SDRAM_BOOLOADER_BUFFER_ADDRESS;
 
+static emmc_ui_progress_state ui_progress_state = EMMC_UI_PROGRESS_STATE_INIT;
+
 static int ui_progress_bar_handle_update(int percentage, const char* title)
 {
-    static uint32_t ui_percentage_last = 0xff;
     char* progress_title = (char*)((title != NULL) ? title : "Transferring Data");
+    emmc_ui_progress_action action = emmc_ui_progress_next_action(
+        &ui_progress_state, true, percentage, ui_progress_bar_is_visible()
+    );
 
-    if ( (percentage < 0) || (percentage > 100) )
+    if ( action == EMMC_UI_PROGRESS_ACTION_INVALID )
     {
         return -1;
     }
 
-    if ( ui_percentage_last == (uint32_t)percentage )
+    if ( action == EMMC_UI_PROGRESS_ACTION_NONE )
     {
         return 0;
     }
 
-    ui_percentage_last = (uint32_t)percentage;
-
-    if ( percentage < 100 )
+    if ( action == EMMC_UI_PROGRESS_ACTION_UPDATE )
     {
         ui_screen_progress_bar_update(progress_title, NULL, percentage);
     }
-    else
+    else if ( action == EMMC_UI_PROGRESS_ACTION_COMPLETE )
     {
         ui_screen_progress_bar_update(progress_title, NULL, percentage);
         ui_fadeout();
@@ -44,9 +47,15 @@ static int ui_progress_bar_handle_update(int percentage, const char* title)
 
 static void ui_progress_bar_handle_clear(void)
 {
-    ui_progress_bar_visible_clear();
-    display_clear();
-    ui_bootloader_first(NULL);
+    emmc_ui_progress_action action = emmc_ui_progress_next_action(
+        &ui_progress_state, false, 0, ui_progress_bar_is_visible()
+    );
+
+    if ( action == EMMC_UI_PROGRESS_ACTION_CLEAR )
+    {
+        display_clear();
+        ui_bootloader_first(NULL);
+    }
 }
 
 static void packet_generate_first(
@@ -649,14 +658,19 @@ static int check_file_contents(uint8_t iface_num, const uint8_t* buffer, uint32_
             // check firmware header
             // check file header
             ExecuteCheck_MSGS_ADV(
-                load_vendor_header(p_data, FW_KEY_M, FW_KEY_N, FW_KEYS, &file_vhdr), sectrue,
+                load_vendor_header(p_data, buffer_len, FW_KEY_M, FW_KEY_N, FW_KEYS, &file_vhdr), sectrue,
                 {
                     send_failure(
                         iface_num, FailureType_Failure_ProcessError, "Update file vendor header invalid!"
                     );
                     return -1;
                 }
             );
+            if ( file_vhdr.hdrlen > buffer_len || buffer_len - file_vhdr.hdrlen < IMAGE_HEADER_SIZE )
+            {
+                send_failure(iface_num, FailureType_Failure_ProcessError, "Update file header truncated!");
+                return -1;
+            }
             ExecuteCheck_MSGS_ADV(
                 load_image_header(
                     p_data + file_vhdr.hdrlen, FIRMWARE_IMAGE_MAGIC, FIRMWARE_IMAGE_MAXSIZE, file_vhdr.vsig_m,
@@ -669,6 +683,14 @@ static int check_file_contents(uint8_t iface_num, const uint8_t* buffer, uint32_
                 }
             );
 
+            uint32_t firmware_item_len = file_vhdr.hdrlen + file_hdr.hdrlen;
+            if ( firmware_item_len > buffer_len || file_hdr.codelen > buffer_len - firmware_item_len )
+            {
+                send_failure(iface_num, FailureType_Failure_ProcessError, "Firmware file truncated!");
+                return -1;
+            }
+            firmware_item_len += file_hdr.codelen;
+
             if ( file_hdr.codelen - (FIRMWARE_IMAGE_INNER_SIZE - (file_vhdr.hdrlen + file_hdr.hdrlen)) >
                  FMC_SDRAM_FIRMWARE_P2_LEN )
             {
@@ -691,7 +713,7 @@ static int check_file_contents(uint8_t iface_num, const uint8_t* buffer, uint32_
 
             // check file size
             ExecuteCheck_MSGS_ADV(
-                (file_vhdr.hdrlen + file_hdr.hdrlen + file_hdr.codelen <= FIRMWARE_IMAGE_MAXSIZE), true,
+                (firmware_item_len <= FIRMWARE_IMAGE_MAXSIZE), true,
                 {
                     send_failure(iface_num, FailureType_Failure_ProcessError, "Firmware file is too big!");
                     return -1;
@@ -703,7 +725,8 @@ static int check_file_contents(uint8_t iface_num, const uint8_t* buffer, uint32_
             update_info.mcu_update_info.purpose_changed = secfalse;
             // vhdr
             if ( load_vendor_header(
-                     (const uint8_t*)FIRMWARE_START, FW_KEY_M, FW_KEY_N, FW_KEYS, &current_vhdr
+                     (const uint8_t*)FIRMWARE_START, VENDOR_HEADER_MAX_SIZE, FW_KEY_M, FW_KEY_N, FW_KEYS,
+                     &current_vhdr
                  ) == sectrue )
             {
                 if ( load_image_header(
@@ -773,14 +796,13 @@ static int check_file_contents(uint8_t iface_num, const uint8_t* buffer, uint32_
 
             update_info.items[update_info.item_count].type = UPDATE_MCU;
             update_info.items[update_info.item_count].offset = p_data - buffer;
-            update_info.items[update_info.item_count].length =
-                file_vhdr.hdrlen + file_hdr.hdrlen + file_hdr.codelen;
+            update_info.items[update_info.item_count].length = firmware_item_len;
             update_info.item_count++;
             update_info.mcu_location = update_info.item_count;
             update_info.mcu_update_info.purpose = file_hdr.purpose;
 
-            p_data += file_vhdr.hdrlen + file_hdr.hdrlen + file_hdr.codelen;
-            buffer_len -= file_vhdr.hdrlen + file_hdr.hdrlen + file_hdr.codelen;
+            p_data += firmware_item_len;
+            buffer_len -= firmware_item_len;
             continue;
         }
         // SE

core/embed/emmc_wrapper/emmc_ui_progress.c

@@ -0,0 +1,39 @@
+#include "emmc_ui_progress.h"
+
+static void emmc_ui_progress_state_reset(emmc_ui_progress_state* state)
+{
+    state->last_percentage = 0;
+    state->has_last_percentage = false;
+}
+
+emmc_ui_progress_action emmc_ui_progress_next_action(
+    emmc_ui_progress_state* state, bool has_percentage, int percentage, bool progress_visible
+)
+{
+    if ( !has_percentage )
+    {
+        emmc_ui_progress_state_reset(state);
+        return progress_visible ? EMMC_UI_PROGRESS_ACTION_CLEAR : EMMC_UI_PROGRESS_ACTION_NONE;
+    }
+
+    if ( (percentage < 0) || (percentage > 100) )
+    {
+        return EMMC_UI_PROGRESS_ACTION_INVALID;
+    }
+
+    if ( progress_visible && state->has_last_percentage && state->last_percentage == (uint32_t)percentage )
+    {
+        return EMMC_UI_PROGRESS_ACTION_NONE;
+    }
+
+    state->last_percentage = (uint32_t)percentage;
+    state->has_last_percentage = true;
+
+    if ( percentage == 100 )
+    {
+        emmc_ui_progress_state_reset(state);
+        return EMMC_UI_PROGRESS_ACTION_COMPLETE;
+    }
+
+    return EMMC_UI_PROGRESS_ACTION_UPDATE;
+}