feat(core/prodtest): allow resetting the secret storage in non-production builds
What the developer wrote
Authored by tychovrahe
feat(core/prodtest): allow resetting the secret storage in non-production builds
[no changelog]
What changed, and why it matters
This commit adds a new factory-testing command called secrets-reset that erases the device's secret storage area. It is only compiled into non-production (debug/test) builds, so it cannot be used on normal consumer Trezor devices. The change exposes an internal erase function so the test tool can call it.
No immediate action required for end-user security. For the project, verify that PRODUCTION is always defined in release firmware builds and that the prodtest binary cannot be loaded or executed on production devices. Consider adding compile-time or runtime checks to prevent accidental inclusion of secrets-reset in shipping firmware.
Security signals we found
Adds a secret-storage erase command
Command is gated by non-production build flag (#if !PRODUCTION)
Exposes previously internal secret_erase() function globally
Intended for production-line testing / debugging builds
Evidence from the diff
The patch adds a prodtest CLI command secrets-reset guarded by #if !PRODUCTION. It calls secret_erase(), which was previously a static helper in both STM32F4 and STM32U5 secret.c files. The function is now declared in the public header and made non-static so the prodtest command can use it. The command takes no arguments and erases the whole secret flash area after reconfiguring the MPU and restores the MPU afterward.
Changed components
core/embed/projects/prodtest/cmd/prodtest_secrets.ccore/embed/sec/secret/inc/sec/secret.hcore/embed/sec/secret/stm32f4/secret.ccore/embed/sec/secret/stm32u5/secret.cInspect captured patch +28 / −2
diff --git a/core/embed/projects/prodtest/cmd/prodtest_secrets.c b/core/embed/projects/prodtest/cmd/prodtest_secrets.c
index 6b2c20a4..291e972a 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_secrets.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_secrets.c
@@ -350,6 +350,19 @@ static void prodtest_secrets_lock(cli_t* cli) {
}
#endif
+#if !PRODUCTION
+static void prodtest_secrets_reset(cli_t* cli) {
+ if (cli_arg_count(cli) > 0) {
+ cli_error_arg_count(cli);
+ return;
+ }
+
+ secret_erase();
+
+ cli_ok(cli, "");
+}
+#endif
+
// clang-format off
PRODTEST_CLI_CMD(
@@ -391,5 +404,13 @@ PRODTEST_CLI_CMD(
);
#endif
+#if !PRODUCTION
+PRODTEST_CLI_CMD(
+ .name = "secrets-reset",
+ .func = prodtest_secrets_reset,
+ .info = "Erase the whole secret sector",
+ .args = ""
+);
+
#endif
#endif
diff --git a/core/embed/sec/secret/inc/sec/secret.h b/core/embed/sec/secret/inc/sec/secret.h
index 4823fd76..920af316 100644
--- a/core/embed/sec/secret/inc/sec/secret.h
+++ b/core/embed/sec/secret/inc/sec/secret.h
@@ -104,6 +104,11 @@ void secret_prepare_fw(secbool allow_run_with_secret,
*/
void secret_init(void);
+/**
+ * @brief Erases the entire secret storage area.
+ */
+void secret_erase(void);
+
/**
* @brief Disables access to the data in the storage in case
* of a failure or an attack.
diff --git a/core/embed/sec/secret/stm32f4/secret.c b/core/embed/sec/secret/stm32f4/secret.c
index 038af0e4..beb3bcf3 100644
--- a/core/embed/sec/secret/stm32f4/secret.c
+++ b/core/embed/sec/secret/stm32f4/secret.c
@@ -63,7 +63,7 @@ secbool secret_verify_header(void) {
return bootloader_locked;
}
-static void secret_erase(void) {
+void secret_erase(void) {
mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_SECRET);
ensure(flash_area_erase(&SECRET_AREA, NULL), "secret erase");
mpu_restore(mpu_mode);
diff --git a/core/embed/sec/secret/stm32u5/secret.c b/core/embed/sec/secret/stm32u5/secret.c
index 8c2a7126..80e3b591 100644
--- a/core/embed/sec/secret/stm32u5/secret.c
+++ b/core/embed/sec/secret/stm32u5/secret.c
@@ -119,7 +119,7 @@ static secbool secret_verify_header(void) {
return header_present;
}
-static void secret_erase(void) {
+void secret_erase(void) {
mpu_mode_t mpu_mode = mpu_reconfig(MPU_MODE_SECRET);
ensure(flash_area_erase(&SECRET_AREA, NULL), "secret erase");
mpu_restore(mpu_mode);
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.