securechip: decouple from C bitbox02 memory impl
What changed, and why it matters
This commit is a routine internal refactoring: it moves the lookup of which secure chip type (ATECC or Optiga) is present from an older C memory module to a newer Rust memory module. The actual chip-detection logic and behavior do not change; only which internal API is called. There is no indication this fixes or introduces a security vulnerability.
No security action required; review as normal refactoring.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch decouples securechip.c from the C memory implementation (memory/memory.h, memory/memory_shared.h) and instead calls a new Rust-exposed C API rust_memory_get_securechip_type(). It adds a corresponding enum and FFI function in firmware_c_api.rs, plus unit tests. The switch logic in securechip_init() remains functionally identical: Optiga selects optiga_ functions; ATECC/default selects atecc_ functions. No bounds checks, cryptographic operations, or trust assumptions are altered.
Changed components
src/securechip/securechip.csrc/rust/bitbox02-rust-c/src/firmware_c_api.rsInspect captured patch +44 / −7
diff --git a/src/rust/bitbox02-rust-c/src/firmware_c_api.rs b/src/rust/bitbox02-rust-c/src/firmware_c_api.rs
index b1f7f51..ff6110f 100644
--- a/src/rust/bitbox02-rust-c/src/firmware_c_api.rs
+++ b/src/rust/bitbox02-rust-c/src/firmware_c_api.rs
@@ -3,7 +3,18 @@
use core::ffi::c_char;
use util::bytes::{Bytes, BytesMut};
-use bitbox_hal::{Hal, Memory, memory::OptigaConfigVersion};
+use bitbox_hal::{
+ Hal, Memory,
+ memory::{OptigaConfigVersion, SecurechipType},
+};
+
+#[repr(u8)]
+#[derive(Copy, Clone, Debug, Eq, PartialEq)]
+#[allow(non_camel_case_types)]
+pub enum rust_memory_securechip_type_t {
+ RUST_MEMORY_SECURECHIP_TYPE_ATECC = 0,
+ RUST_MEMORY_SECURECHIP_TYPE_OPTIGA = 1,
+}
#[cfg(not(any(feature = "c-unit-testing", feature = "simulator-graphical")))]
#[unsafe(no_mangle)]
@@ -63,6 +74,19 @@ pub extern "C" fn rust_memory_set_optiga_config_version_v1() -> bool {
.is_ok()
}
+#[unsafe(no_mangle)]
+pub extern "C" fn rust_memory_get_securechip_type() -> rust_memory_securechip_type_t {
+ let mut hal = crate::HalImpl::new();
+ match hal.memory().get_securechip_type() {
+ Ok(SecurechipType::Optiga) => {
+ rust_memory_securechip_type_t::RUST_MEMORY_SECURECHIP_TYPE_OPTIGA
+ }
+ Ok(SecurechipType::Atecc) | Err(()) => {
+ rust_memory_securechip_type_t::RUST_MEMORY_SECURECHIP_TYPE_ATECC
+ }
+ }
+}
+
#[cfg(feature = "app-u2f")]
#[unsafe(no_mangle)]
pub extern "C" fn rust_keystore_get_u2f_seed(mut seed_out: util::bytes::BytesMut) -> bool {
@@ -79,7 +103,8 @@ pub extern "C" fn rust_keystore_get_u2f_seed(mut seed_out: util::bytes::BytesMut
mod tests {
use super::*;
use bitbox02::memory::{
- OptigaConfigVersion as MemoryOptigaConfigVersion, set_optiga_config_version,
+ OptigaConfigVersion as MemoryOptigaConfigVersion, SecurechipType as MemorySecurechipType,
+ get_securechip_type, set_optiga_config_version,
};
fn setup_memory() {
@@ -106,4 +131,17 @@ mod tests {
setup_memory();
assert!(!unsafe { rust_memory_optiga_config_is_v1_or_higher(core::ptr::null_mut()) });
}
+
+ #[test]
+ fn test_rust_memory_get_securechip_type() {
+ let expected = match get_securechip_type().unwrap() {
+ MemorySecurechipType::Atecc => {
+ rust_memory_securechip_type_t::RUST_MEMORY_SECURECHIP_TYPE_ATECC
+ }
+ MemorySecurechipType::Optiga => {
+ rust_memory_securechip_type_t::RUST_MEMORY_SECURECHIP_TYPE_OPTIGA
+ }
+ };
+ assert_eq!(rust_memory_get_securechip_type(), expected);
+ }
}
diff --git a/src/securechip/securechip.c b/src/securechip/securechip.c
index 023b8ad..893eb10 100644
--- a/src/securechip/securechip.c
+++ b/src/securechip/securechip.c
@@ -4,9 +4,8 @@
#include <atecc/atecc.h>
#include <hardfault.h>
-#include <memory/memory.h>
-#include <memory/memory_shared.h>
#include <optiga/optiga.h>
+#include <rust/rust.h>
typedef struct {
int (*setup)(const securechip_interface_functions_t* fns);
@@ -38,8 +37,8 @@ static securechip_crypt_interface_t _fns = {0};
// Detect if we have atecc or optiga chip and set interface functions
bool securechip_init(void)
{
- switch (memory_get_securechip_type()) {
- case MEMORY_SECURECHIP_TYPE_OPTIGA:
+ switch (rust_memory_get_securechip_type()) {
+ case RUST_MEMORY_SECURECHIP_TYPE_OPTIGA:
_fns.setup = optiga_setup;
_fns.kdf = optiga_kdf_external;
_fns.init_new_password = optiga_init_new_password;
@@ -57,7 +56,7 @@ bool securechip_init(void)
#endif
_fns.model = optiga_model;
break;
- case MEMORY_SECURECHIP_TYPE_ATECC:
+ case RUST_MEMORY_SECURECHIP_TYPE_ATECC:
default:
_fns.setup = atecc_setup;
_fns.kdf = atecc_kdf;
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.