Informational 16 Bitcoin Committed Feb 16, 2026 · 10:18 UTC

fix(core): PLL_DSI_NDIV wrongly set for DISC2

4e197793 View source ↗

Public commit record

What the developer wrote

Authored by bleska

80/100 · Strong

fix(core): PLL_DSI_NDIV wrongly set for DISC2

The PLL_DSI_NDIV macro has been redefined to be calculated out of the other PLL_DSI parameters and the HSE_VALUE.

[no changelog]

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context

The short version

What changed, and why it matters

This commit fixes a display clock configuration for three Trezor hardware screen variants. The clock divider value was hard-coded to 62, but the formula shows it should be calculated from the external crystal frequency. On the DISC2 board the crystal runs at a different speed, so the hard-coded value produced the wrong DSI display clock. This is a hardware initialization bug that could cause display corruption or failure to light up the screen on DISC2; it is not a software vulnerability that an attacker can exploit.

Recommended action

Treat as a normal functional/bug-fix commit. No security response required. If DISC2 devices experienced display issues, verify the fix with hardware QA.

Security signals we found

No attacker-controlled input is processed

No memory corruption, privilege escalation, or cryptographic weakness introduced

Change is confined to display panel header constants

Commit title and message describe a functional hardware clocking fix, not a security issue

Technical analysis

Evidence from the diff

The change replaces a hard-coded PLL_DSI_NDIV value of 62 with the intended macro formula: (DSI_LANE_BYTE_CLOCK_HZ * 8 * PLL_DSI_ODF * PLL_DSI_IDF) / (2 * HSE_VALUE). HSE_VALUE differs across boards (e.g., 16 MHz vs other values), so the hard-coded 62 was only correct for some boards and wrong for DISC2. The fix makes the DSI PLL feedback divider derive from HSE_VALUE, restoring the correct byte clock for the DSI display interface. There is no code path here that processes attacker-controlled data; the bug is purely a static clocking misconfiguration.

Changed components

core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.hcore/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.hcore/embed/io/display/ltdc_dsi/panels/stm32u5a9j-dk/stm32u5a9j-dk.h

Inspect captured patch +6 / −9

diff --git a/core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.h b/core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.h
index eff4aeae..83d27269 100644
--- a/core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.h
+++ b/core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.h
@@ -28,9 +28,8 @@
 // PLL_DSI_ODF) / 8
 #define DSI_LANE_BYTE_CLOCK_HZ 62000000UL  // PLL DSI
 #define PLL_DSI_IDF 4
-// PLL_DSI_NDIV = (DSI_LANE_BYTE_CLOCK_HZ * 8 * PLL_DSI_ODF * PLL_DSI_IDF) / (2
-// * HSE_VALUE)
-#define PLL_DSI_NDIV 62
+#define PLL_DSI_NDIV \
+  ((DSI_LANE_BYTE_CLOCK_HZ * 8 * PLL_DSI_ODF * PLL_DSI_IDF) / (2 * HSE_VALUE))
 #define PLL_DSI_ODF 2
 #define DSI_DPHY_FRANGE DSI_DPHY_FRANGE_450MHZ_510MHZ
 #define DSI_TX_ESCAPE_CLK_DIV 4  // 15.5MHz, ~7.75MHz (in LP)
diff --git a/core/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.h b/core/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.h
index 80b14d53..ba1cd0b9 100644
--- a/core/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.h
+++ b/core/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.h
@@ -31,9 +31,8 @@
 // PLL_DSI_ODF) / 8
 #define DSI_LANE_BYTE_CLOCK_HZ 62000000UL  // PLL DSI
 #define PLL_DSI_IDF 4
-// PLL_DSI_NDIV = (DSI_LANE_BYTE_CLOCK_HZ * 8 * PLL_DSI_ODF * PLL_DSI_IDF) / (2
-// * HSE_VALUE)
-#define PLL_DSI_NDIV 62
+#define PLL_DSI_NDIV \
+  ((DSI_LANE_BYTE_CLOCK_HZ * 8 * PLL_DSI_ODF * PLL_DSI_IDF) / (2 * HSE_VALUE))
 #define PLL_DSI_ODF 2
 #define DSI_DPHY_FRANGE DSI_DPHY_FRANGE_450MHZ_510MHZ
 #define DSI_TX_ESCAPE_CLK_DIV 4  // 15.5MHz, ~7.75MHz (in LP)
diff --git a/core/embed/io/display/ltdc_dsi/panels/stm32u5a9j-dk/stm32u5a9j-dk.h b/core/embed/io/display/ltdc_dsi/panels/stm32u5a9j-dk/stm32u5a9j-dk.h
index d68f0c83..f79d753d 100644
--- a/core/embed/io/display/ltdc_dsi/panels/stm32u5a9j-dk/stm32u5a9j-dk.h
+++ b/core/embed/io/display/ltdc_dsi/panels/stm32u5a9j-dk/stm32u5a9j-dk.h
@@ -28,9 +28,8 @@
 // PLL_DSI_ODF) / 8
 #define DSI_LANE_BYTE_CLOCK_HZ 62000000UL  // PLL DSI
 #define PLL_DSI_IDF 4
-// PLL_DSI_NDIV = (DSI_LANE_BYTE_CLOCK_HZ * 8 * PLL_DSI_ODF * PLL_DSI_IDF) / (2
-// * HSE_VALUE)
-#define PLL_DSI_NDIV 62
+#define PLL_DSI_NDIV \
+  ((DSI_LANE_BYTE_CLOCK_HZ * 8 * PLL_DSI_ODF * PLL_DSI_IDF) / (2 * HSE_VALUE))
 #define PLL_DSI_ODF 2
 #define DSI_DPHY_FRANGE DSI_DPHY_FRANGE_450MHZ_510MHZ
 #define DSI_TX_ESCAPE_CLK_DIV 4  // 15.5MHz, ~7.75MHz (in LP)

Risk score

Why this scored 16/100

Our methodology →

Potential impact 2/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 2/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 16/100

Community notes

Related watches

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding

test(core): test RLP self-encoding bytestrings

chore(core): remove sha1 from regular FW