Fix issues related to version 4.12.0 (#256)

* Disable SPI CS IRQ for old firmware compatibility.

* Fix auto-shutdown bug

* Limit minimum screen brightness.

* Check support before calling SE FIDO-related commands.

* Update MPU configuration.

core/embed/bootloader/main.c

@@ -792,6 +792,10 @@ int main(void) {
 
     bus_fault_disable();
 
+    // Disable SPI Chip Select interrupt for compatibility with older firmware
+    // versions
+    spi_disable_cs_irq();
+
     // enable firmware region
     mpu_config_firmware(sectrue, sectrue);
 

core/embed/trezorhal/low_power.c

@@ -128,7 +128,11 @@ void rtc_init(void) {
   rtc_inited = true;
 }
 
-void rtc_disable(void) { HAL_RTCEx_DeactivateWakeUpTimer(&RTCHandle); }
+void rtc_disable(void) {
+  rtc_init();
+  HAL_RTCEx_DeactivateWakeUpTimer(&RTCHandle);
+  wakeup_by_rtc = false;
+}
 
 // period in seconds
 void rtc_set_period(uint32_t period) {
@@ -154,6 +158,7 @@ void enter_stop_mode(bool restart, uint32_t shutdown_seconds, bool wake_up) {
   }
   if (restart && shutdown_seconds) {
     seconds = shutdown_seconds;
+    rtc_disable();
   }
   camera_power_off();
   fpsensor_irq_disable();

core/embed/trezorhal/mpu.c

@@ -37,15 +37,17 @@
 #define MPU_REGION_SDRAM MPU_REGION_NUMBER2
 #define MPU_REGION_FLASH MPU_REGION_NUMBER3
 #define MPU_REGION_FLASH_OTP MPU_REGION_NUMBER4
+#define MPU_REGION_SDRAM_LCD_FRAMEBUFFER MPU_REGION_NUMBER5
+
 // stages
-#define MPU_REGION_FLASH_BOARD MPU_REGION_NUMBER5
-#define MPU_REGION_FLASH_BOOT MPU_REGION_NUMBER6
-#define MPU_REGION_FLASH_FWBK1 MPU_REGION_NUMBER7
-#define MPU_REGION_FLASH_FWBK2 MPU_REGION_NUMBER8
-#define MPU_REGION_SDRAM_FW MPU_REGION_NUMBER9
+#define MPU_REGION_FLASH_BOARD MPU_REGION_NUMBER6
+#define MPU_REGION_FLASH_BOOT MPU_REGION_NUMBER7
+#define MPU_REGION_FLASH_FWBK1 MPU_REGION_NUMBER8
+#define MPU_REGION_FLASH_FWBK2 MPU_REGION_NUMBER9
 // --- misc
-#define MPU_REGION_SRAM3_DMA MPU_REGION_NUMBER10
-#define MPU_REGION_QSPI_FLASH MPU_REGION_NUMBER11
+#define MPU_REGION_QSPI_FLASH MPU_REGION_NUMBER10
+#define MPU_REGION_SDRAM_DISPLAY_BUFFER MPU_REGION_NUMBER11
+
 // --- flash subregion for stages
 #define MPU_SUBREGION_MASK_BK1_BOARD (uint8_t)(~0b00000001U)
 #define MPU_SUBREGION_MASK_BK1_BOOT (uint8_t)(~0b00000110U)
@@ -92,7 +94,7 @@ void mpu_config_base() {
     mpu_init_struct.TypeExtField = MPU_TEX_LEVEL1;
     mpu_init_struct.AccessPermission = MPU_REGION_FULL_ACCESS;
     mpu_init_struct.DisableExec = MPU_INSTRUCTION_ACCESS_DISABLE;
-    mpu_init_struct.IsShareable = MPU_ACCESS_SHAREABLE;
+    mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
     mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
     mpu_init_struct.IsBufferable = MPU_ACCESS_BUFFERABLE;
     HAL_MPU_ConfigRegion(&mpu_init_struct);
@@ -105,16 +107,16 @@ void mpu_config_base() {
     mpu_init_struct.BaseAddress = 0xD0000000;
     mpu_init_struct.Size = MPU_REGION_SIZE_32MB;
     mpu_init_struct.SubRegionDisable = 0x00;
-    mpu_init_struct.TypeExtField = MPU_TEX_LEVEL0;
+    mpu_init_struct.TypeExtField = MPU_TEX_LEVEL1;
     mpu_init_struct.AccessPermission = MPU_REGION_FULL_ACCESS;
     mpu_init_struct.DisableExec = MPU_INSTRUCTION_ACCESS_DISABLE;
     mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
     mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
-    mpu_init_struct.IsBufferable = MPU_ACCESS_NOT_BUFFERABLE;
+    mpu_init_struct.IsBufferable = MPU_ACCESS_BUFFERABLE;
     HAL_MPU_ConfigRegion(&mpu_init_struct);
   }
 
-  // FLASH
+  // FLASH, write through cache,keep default config
   {
     mpu_init_struct.Enable = MPU_REGION_ENABLE;
     mpu_init_struct.Number = MPU_REGION_FLASH;
@@ -125,7 +127,7 @@ void mpu_config_base() {
     mpu_init_struct.AccessPermission = MPU_REGION_NO_ACCESS;
     mpu_init_struct.DisableExec = MPU_INSTRUCTION_ACCESS_DISABLE;
     mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
-    mpu_init_struct.IsCacheable = MPU_ACCESS_NOT_CACHEABLE;
+    mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
     mpu_init_struct.IsBufferable = MPU_ACCESS_NOT_BUFFERABLE;
     HAL_MPU_ConfigRegion(&mpu_init_struct);
   }
@@ -142,7 +144,22 @@ void mpu_config_base() {
     // mpu_init_struct.AccessPermission = MPU_REGION_FULL_ACCESS;
     mpu_init_struct.DisableExec = MPU_INSTRUCTION_ACCESS_DISABLE;
     mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
-    mpu_init_struct.IsCacheable = MPU_ACCESS_NOT_CACHEABLE;
+    mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
+    mpu_init_struct.IsBufferable = MPU_ACCESS_NOT_BUFFERABLE;
+    HAL_MPU_ConfigRegion(&mpu_init_struct);
+  }
+  // SDRAM LCD framebuffer, write through cache
+  {
+    mpu_init_struct.Enable = MPU_REGION_ENABLE;
+    mpu_init_struct.Number = MPU_REGION_SDRAM_LCD_FRAMEBUFFER;
+    mpu_init_struct.BaseAddress = FMC_SDRAM_LTDC_BUFFER_ADDRESS;
+    mpu_init_struct.Size = MPU_REGION_SIZE_2MB;
+    mpu_init_struct.SubRegionDisable = 0x00;
+    mpu_init_struct.TypeExtField = MPU_TEX_LEVEL0;
+    mpu_init_struct.AccessPermission = MPU_REGION_FULL_ACCESS;
+    mpu_init_struct.DisableExec = MPU_INSTRUCTION_ACCESS_DISABLE;
+    mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
+    mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
     mpu_init_struct.IsBufferable = MPU_ACCESS_NOT_BUFFERABLE;
     HAL_MPU_ConfigRegion(&mpu_init_struct);
   }
@@ -164,9 +181,9 @@ void mpu_config_boardloader(secbool access, secbool exec) {
     mpu_init_struct.DisableExec =
         ((exec == sectrue) ? MPU_INSTRUCTION_ACCESS_ENABLE
                            : MPU_INSTRUCTION_ACCESS_DISABLE);
-    mpu_init_struct.IsShareable = MPU_ACCESS_SHAREABLE;
+    mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
     mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
-    mpu_init_struct.IsBufferable = MPU_ACCESS_BUFFERABLE;
+    mpu_init_struct.IsBufferable = MPU_ACCESS_NOT_BUFFERABLE;
     HAL_MPU_ConfigRegion(&mpu_init_struct);
   }
 }
@@ -187,24 +204,8 @@ void mpu_config_bootloader(secbool access, secbool exec) {
     mpu_init_struct.DisableExec =
         ((exec == sectrue) ? MPU_INSTRUCTION_ACCESS_ENABLE
                            : MPU_INSTRUCTION_ACCESS_DISABLE);
-    mpu_init_struct.IsShareable = MPU_ACCESS_SHAREABLE;
-    mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
-    mpu_init_struct.IsBufferable = MPU_ACCESS_BUFFERABLE;
-    HAL_MPU_ConfigRegion(&mpu_init_struct);
-  }
-
-  // SRAM3 SPI DMA
-  {
-    mpu_init_struct.Enable = MPU_REGION_ENABLE;
-    mpu_init_struct.Number = MPU_REGION_SRAM3_DMA;
-    mpu_init_struct.BaseAddress = 0x30040000;
-    mpu_init_struct.Size = MPU_REGION_SIZE_32KB;
-    mpu_init_struct.SubRegionDisable = 0x00;
-    mpu_init_struct.TypeExtField = MPU_TEX_LEVEL1;
-    mpu_init_struct.AccessPermission = MPU_REGION_FULL_ACCESS;
-    mpu_init_struct.DisableExec = MPU_INSTRUCTION_ACCESS_DISABLE;
     mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
-    mpu_init_struct.IsCacheable = MPU_ACCESS_NOT_CACHEABLE;
+    mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
     mpu_init_struct.IsBufferable = MPU_ACCESS_NOT_BUFFERABLE;
     HAL_MPU_ConfigRegion(&mpu_init_struct);
   }
@@ -244,7 +245,7 @@ secbool mpu_config_firmware(secbool access, secbool exec) {
                            : MPU_INSTRUCTION_ACCESS_DISABLE);
     mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
     mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
-    mpu_init_struct.IsBufferable = MPU_ACCESS_BUFFERABLE;
+    mpu_init_struct.IsBufferable = MPU_ACCESS_NOT_BUFFERABLE;
     HAL_MPU_ConfigRegion(&mpu_init_struct);
   }
 
@@ -263,26 +264,22 @@ secbool mpu_config_firmware(secbool access, secbool exec) {
                            : MPU_INSTRUCTION_ACCESS_DISABLE);
     mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
     mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
-    mpu_init_struct.IsBufferable = MPU_ACCESS_BUFFERABLE;
+    mpu_init_struct.IsBufferable = MPU_ACCESS_NOT_BUFFERABLE;
     HAL_MPU_ConfigRegion(&mpu_init_struct);
   }
-
-  // SDRAM
+  // SDRAM LCD/LVGL/JPEGDecoder buffer, write through cache
   {
     mpu_init_struct.Enable = MPU_REGION_ENABLE;
-    mpu_init_struct.Number = MPU_REGION_SDRAM_FW;
-    mpu_init_struct.BaseAddress = FMC_SDRAM_FIRMWARE_P2_ADDRESS;
-    mpu_init_struct.Size = MPU_REGION_SIZE_2MB;
+    mpu_init_struct.Number = MPU_REGION_SDRAM_DISPLAY_BUFFER;
+    mpu_init_struct.BaseAddress = FMC_SDRAM_LTDC_BUFFER_ADDRESS;
+    mpu_init_struct.Size = MPU_REGION_SIZE_8MB;
     mpu_init_struct.SubRegionDisable = 0x00;
     mpu_init_struct.TypeExtField = MPU_TEX_LEVEL0;
-    mpu_init_struct.AccessPermission =
-        ((access == sectrue) ? MPU_REGION_FULL_ACCESS : MPU_REGION_NO_ACCESS);
-    mpu_init_struct.DisableExec =
-        ((exec == sectrue) ? MPU_INSTRUCTION_ACCESS_ENABLE
-                           : MPU_INSTRUCTION_ACCESS_DISABLE);
+    mpu_init_struct.AccessPermission = MPU_REGION_FULL_ACCESS;
+    mpu_init_struct.DisableExec = MPU_INSTRUCTION_ACCESS_DISABLE;
     mpu_init_struct.IsShareable = MPU_ACCESS_NOT_SHAREABLE;
     mpu_init_struct.IsCacheable = MPU_ACCESS_CACHEABLE;
-    mpu_init_struct.IsBufferable = MPU_ACCESS_BUFFERABLE;
+    mpu_init_struct.IsBufferable = MPU_ACCESS_NOT_BUFFERABLE;
     HAL_MPU_ConfigRegion(&mpu_init_struct);
   }
   __asm__ volatile("dsb");

core/embed/trezorhal/sdram.h

@@ -48,15 +48,15 @@
   (FMC_SDRAM_ADDRESS + FMC_SDRAM_LTDC_BUFFER_LEN)  // 0xD0200000
 #define FMC_SDRAM_LVGL_BUFFER_LEN MB(2)            // 0xD0400000
 
-#define FMC_SDRAM_USER_HEAP_ADDRESS                \
+#define FMC_SDRAM_JPEG_OUTPUT_DATA_BUFFER_ADDRESS  \
   (FMC_SDRAM_ADDRESS + FMC_SDRAM_LTDC_BUFFER_LEN + \
-   FMC_SDRAM_LVGL_BUFFER_LEN)           // 0xD0400000
-#define FMC_SDRAM_USER_HEAP_LEN MB(20)  // 0xD1800000
+   FMC_SDRAM_LVGL_BUFFER_LEN)                        // 0xD0400000
+#define FMC_SDRAM_JPEG_OUTPUT_DATA_BUFFER_LEN MB(4)  // 0xD0800000
 
-#define FMC_SDRAM_JPEG_OUTPUT_DATA_BUFFER_ADDRESS                              \
+#define FMC_SDRAM_USER_HEAP_ADDRESS                                            \
   (FMC_SDRAM_ADDRESS + FMC_SDRAM_LTDC_BUFFER_LEN + FMC_SDRAM_LVGL_BUFFER_LEN + \
-   FMC_SDRAM_USER_HEAP_LEN)                          // 0xD1800000
-#define FMC_SDRAM_JPEG_OUTPUT_DATA_BUFFER_LEN MB(4)  // 0xD1C00000
+   FMC_SDRAM_JPEG_OUTPUT_DATA_BUFFER_LEN)  // 0xD0800000
+#define FMC_SDRAM_USER_HEAP_LEN MB(20)     // 0xD1C00000
 
 #define FMC_SDRAM_FIRMWARE_P2_ADDRESS                                          \
   (FMC_SDRAM_ADDRESS + FMC_SDRAM_LTDC_BUFFER_LEN + FMC_SDRAM_LVGL_BUFFER_LEN + \

core/embed/trezorhal/spi_legacy.c

@@ -91,6 +91,7 @@ void HAL_SPI_RxCpltCallback(SPI_HandleTypeDef* hspi)
     {
         spi_rx_event = 0;
     }
+    SCB_CleanInvalidateDCache();
     if ( !fifo_write_no_overflow(&spi_fifo_in, dma_recv_buf, hspi->RxXferSize) )
     {
         memset(dma_recv_buf, 0, hspi->RxXferSize);
@@ -263,6 +264,16 @@ int32_t spi_slave_init()
     return 0;
 }
 
+void spi_disable_cs_irq(void)
+{
+    EXTI_HandleTypeDef hexti = {0};
+    EXTI_ConfigTypeDef pExtiConfig;
+    pExtiConfig.Line = EXTI_LINE_11;
+    pExtiConfig.Mode = EXTI_MODE_NONE;
+    pExtiConfig.GPIOSel = EXTI_GPIOA;
+    HAL_EXTI_SetConfigLine(&hexti, &pExtiConfig);
+}
+
 int32_t spi_slave_send(uint8_t* buf, uint32_t size, int32_t timeout)
 {
     uint32_t msg_size;
@@ -278,7 +289,7 @@ int32_t spi_slave_send(uint8_t* buf, uint32_t size, int32_t timeout)
     }
     while ( spi_abort_event )
         ;
-
+    SCB_CleanInvalidateDCache();
     if ( HAL_SPI_Transmit_DMA(&spi, dma_send_buf, msg_size) != HAL_OK )
     {
         goto END;
@@ -435,6 +446,7 @@ void spi_cs_irq_handler(void)
         if ( recv_len > 0 )
         {
             ST_BLE_STATUS_IO_BUSY();
+            SCB_CleanInvalidateDCache();
             fifo_write_no_overflow(&spi_fifo_in, dma_recv_buf, recv_len);
             ST_BLE_STATUS_IO_IDLE();
         }

core/embed/trezorhal/spi_legacy.h

@@ -40,7 +40,7 @@ uint32_t spi_read_retry(uint8_t* buf);
 uint32_t spi_read_blocking(uint8_t* buf, int timeout);
 void spi_cs_irq_handler(void);
 uint32_t spi_slave_poll_fido(uint8_t* buf);
-
+void spi_disable_cs_irq(void);
 #endif
 
 #endif

core/embed/trezorhal/usart.c

@@ -145,6 +145,7 @@ void ble_usart_send(uint8_t *buf, uint32_t len) {
     uart_tx_done = false;
     uint32_t send_len = len > UART_PACKET_MAX_LEN ? UART_PACKET_MAX_LEN : len;
     memcpy(dma_uart_send_buf, buf, send_len);
+    SCB_CleanInvalidateDCache();
     HAL_UART_Transmit_DMA(huart, dma_uart_send_buf, send_len);
     uint32_t start = HAL_GetTick();
     while (!uart_tx_done) {
@@ -260,6 +261,7 @@ void UARTx_DMA_TX_IRQHandler(void) { HAL_DMA_IRQHandler(huart->hdmatx); }
 void UARTx_DMA_RX_IRQHandler(void) { HAL_DMA_IRQHandler(huart->hdmarx); }
 
 void HAL_UART_RxCpltCallback(UART_HandleTypeDef *huart) {
+  SCB_CleanInvalidateDCache();
   usart_rev_package_dma(dma_uart_rev_buf, sizeof(dma_uart_rev_buf));
   HAL_UART_Receive_DMA(huart, dma_uart_rev_buf, sizeof(dma_uart_rev_buf));
 }
@@ -276,6 +278,7 @@ void UART4_IRQHandler(void) {
     usart_fifo_len =
         sizeof(dma_uart_rev_buf) - __HAL_DMA_GET_COUNTER(huart->hdmarx);
     if (usart_fifo_len > 0) {
+      SCB_CleanInvalidateDCache();
       usart_rev_package_dma(dma_uart_rev_buf, usart_fifo_len);
     }
     HAL_UART_Receive_DMA(huart, dma_uart_rev_buf, sizeof(dma_uart_rev_buf));

core/src/apps/webauthn/resident_credentials.py

@@ -1,13 +1,15 @@
 from micropython import const
 from typing import Iterator
 
+import storage
 import storage.resident_credentials
 from storage.resident_credentials import MAX_RESIDENT_CREDENTIALS
 
 from .credential import Fido2Credential
 from .fido_seed import ensure_fido_seed
 
 RP_ID_HASH_LENGTH = const(32)
+_ALLOW_RESIDENT_CREDENTIALS = storage.device.get_se01_version() >= "1.1.5"
 
 
 def _credential_from_data(index: int, data: bytes) -> Fido2Credential:
@@ -20,6 +22,8 @@ def _credential_from_data(index: int, data: bytes) -> Fido2Credential:
 
 @ensure_fido_seed
 def find_all() -> Iterator[Fido2Credential]:
+    if not _ALLOW_RESIDENT_CREDENTIALS:
+        return
     registered_count = storage.resident_credentials.get_fido2_counter()
     if registered_count == 0:
         return
@@ -35,6 +39,8 @@ def find_all() -> Iterator[Fido2Credential]:
 
 @ensure_fido_seed
 def find_by_rp_id_hash(rp_id_hash: bytes) -> Iterator[Fido2Credential]:
+    if not _ALLOW_RESIDENT_CREDENTIALS:
+        return
     for index in range(MAX_RESIDENT_CREDENTIALS):
         data = storage.resident_credentials.get(index)
 
@@ -51,6 +57,8 @@ def find_by_rp_id_hash(rp_id_hash: bytes) -> Iterator[Fido2Credential]:
 
 @ensure_fido_seed
 def get_resident_credential(index: int) -> Fido2Credential | None:
+    if not _ALLOW_RESIDENT_CREDENTIALS:
+        return None
     if not 0 <= index < MAX_RESIDENT_CREDENTIALS:
         return None
 
@@ -63,6 +71,8 @@ def get_resident_credential(index: int) -> Fido2Credential | None:
 
 @ensure_fido_seed
 def store_resident_credential(cred: Fido2Credential) -> bool:
+    if not _ALLOW_RESIDENT_CREDENTIALS:
+        return False
     if storage.resident_credentials.get_fido2_counter() >= MAX_RESIDENT_CREDENTIALS:
         return False
 

core/src/trezor/lvglui/scrs/homescreen.py

@@ -3233,6 +3233,8 @@ def on_value_changed(self, event_obj):
         if target == self.slider:
             value = target.get_value()
             self.temp_brightness = value
+            if value < style.BACKLIGHT_MIN:
+                value = style.BACKLIGHT_MIN
             display.backlight(value)
             self.percent.set_text(brightness2_percent_str(value))
 

core/src/trezor/ui/style.py

@@ -11,6 +11,8 @@
 BACKLIGHT_DIM = const(5)
 BACKLIGHT_NONE = const(2)
 BACKLIGHT_MAX = const(255)
+# 4% of the period is the minimum value
+BACKLIGHT_MIN = const(BACKLIGHT_MAX * 4 // 100)
 
 # color palette
 RED = rgb(0xFF, 0x00, 0x00)