refactor(core): dma2d_wait() busy wait removal
What the developer wrote
Authored by bleska
refactor(core): dma2d_wait() busy wait removal
Removing the "KERNEL_MODE" guards as the whole file is guarded. Removing the dma2d_wait() function call as it's called twice in the near location.
[no changelog]
What changed, and why it matters
This commit is a small internal cleanup in the Trezor hardware wallet's graphics driver for STM32 microcontrollers. It removes some conditional compilation guards around DMA2D (a graphics accelerator) reset/clock code and deletes one redundant wait call before a copy operation. There is no claim in the commit that this fixes a security bug, and the changes do not obviously create or fix a vulnerability on their own.
Treat as a routine refactoring. If assessing security impact, review whether removing dma2d_wait() could allow a race between consecutive DMA2D operations, and whether unconditional RCC clock/reset control is safe in all build configurations. No immediate security action is indicated by the commit alone.
Security signals we found
Removal of KERNEL_MODE conditional compilation guards around hardware clock/reset control
Removal of dma2d_wait() busy-wait synchronization before a DMA2D copy operation
No changelog entry and no security-related commit message
Evidence from the diff
The patch modifies core/embed/io/gfx/bitblt/stm32/dma2d_bitblt.c. It removes #ifdef KERNEL_MODE guards from dma2d_init() and dma2d_deinit(), meaning the DMA2D RCC reset/clock enable/disable code now always runs. It also removes a dma2d_wait() call from dma2d_rgba8888_copy_mono4(). The commit message frames this as a refactoring: removing busy waits and redundant guards because the whole file is already guarded. The diff is +2/-6 lines. No security relevance is stated, and no advisory, CVE, or researcher attribution is present.
Changed components
core/embed/io/gfx/bitblt/stm32/dma2d_bitblt.cTrezor Core firmware graphics/bitblt DMA2D driverInspect captured patch +2 / −6
diff --git a/core/embed/io/gfx/bitblt/stm32/dma2d_bitblt.c b/core/embed/io/gfx/bitblt/stm32/dma2d_bitblt.c
index f89549a3..db8f0323 100644
--- a/core/embed/io/gfx/bitblt/stm32/dma2d_bitblt.c
+++ b/core/embed/io/gfx/bitblt/stm32/dma2d_bitblt.c
@@ -72,22 +72,20 @@ void dma2d_init(void) {
memset(drv, 0, sizeof(dma2d_driver_t));
drv->handle.Instance = DMA2D;
-#ifdef KERNEL_MODE
__HAL_RCC_DMA2D_FORCE_RESET();
__HAL_RCC_DMA2D_RELEASE_RESET();
__HAL_RCC_DMA2D_CLK_ENABLE();
-#endif
+
drv->initialized = true;
}
void dma2d_deinit(void) {
dma2d_driver_t* drv = &g_dma2d_driver;
-#ifdef KERNEL_MODE
__HAL_RCC_DMA2D_CLK_DISABLE();
__HAL_RCC_DMA2D_FORCE_RESET();
__HAL_RCC_DMA2D_RELEASE_RESET();
-#endif
+
memset(drv, 0, sizeof(dma2d_driver_t));
}
@@ -578,8 +576,6 @@ bool dma2d_rgba8888_copy_mono4(const gfx_bitblt_t* params) {
return false;
}
- dma2d_wait();
-
const gfx_color32_t* src_gradient = NULL;
gfx_bitblt_t bb_copy = *params;
gfx_bitblt_t* bb = &bb_copy;
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.