refactor(core): panel configuration refactoring.
What the developer wrote
Authored by bleska
refactor(core): panel configuration refactoring.
The arguments' passed to the HAL_DSI_LongWrite() function calls were corrected. Since the code is used in "KERNEL_MODE" => adding the respective preprocessor directives.
[no changelog]
What changed, and why it matters
This commit fixes the length arguments passed to display-panel initialization commands in Trezor firmware. The wrong lengths could have caused some display panels to fail to initialize correctly, but there is no direct evidence this is exploitable for security harm. The commit also wraps the panel driver code in a KERNEL_MODE preprocessor guard so it only compiles in the appropriate build mode.
Treat as a low-risk hardware/display bug fix. No immediate security response is warranted unless further analysis shows the DSI length mismatch can be triggered from untrusted input or cause memory corruption. Review other panel drivers for similar HAL_DSI_LongWrite() length mismatches.
Security signals we found
Incorrect length argument passed to HAL_DSI_LongWrite() in display panel initialization
Potential out-of-bounds read or DSI bus error due to length mismatch
Code now gated by KERNEL_MODE preprocessor directive
Evidence from the diff
The patch corrects the payload-length parameter in several HAL_DSI_LongWrite() calls in two DSI display panel drivers (lx200d2406a and lx250a2401a). Previously the length argument was larger than the actual byte array (e.g., 10 vs. 5 bytes, 8 vs. 7 bytes). This could lead to DSI command transmission errors or undefined behavior during panel initialization. The patch also adds #ifdef KERNEL_MODE guards around the panel source files so they are only compiled in kernel builds.
Changed components
core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.ccore/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.cInspect captured patch +27 / −5
diff --git a/core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.c b/core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.c
index dfbe30ea..e4f05058 100644
--- a/core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.c
+++ b/core/embed/io/display/ltdc_dsi/panels/lx200d2406a/lx200d2406a.c
@@ -1,4 +1,23 @@
-
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifdef KERNEL_MODE
#include <trezor_bsp.h>
#include <trezor_rtl.h>
@@ -231,3 +250,4 @@ bool panel_init(display_driver_t *drv) {
return true;
}
+#endif // KERNEL_MODE
diff --git a/core/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.c b/core/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.c
index 5d86666b..95135dc8 100644
--- a/core/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.c
+++ b/core/embed/io/display/ltdc_dsi/panels/lx250a2401a/lx250a2401a.c
@@ -17,6 +17,7 @@
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
+#ifdef KERNEL_MODE
#include <trezor_bsp.h>
#include <trezor_rtl.h>
@@ -81,7 +82,7 @@ bool panel_init(display_driver_t *drv) {
// Write(Parameter , 0x00);
// Write(Parameter , 0x00);
// Write(Parameter , 0x13);
- ret = HAL_DSI_LongWrite(&drv->hlcd_dsi, 0, DSI_DCS_LONG_PKT_WRITE, 10, 0xFF,
+ ret = HAL_DSI_LongWrite(&drv->hlcd_dsi, 0, DSI_DCS_LONG_PKT_WRITE, 5, 0xFF,
(uint8_t[]){0x77, 0x01, 0x00, 0x00, 0x13});
if (ret != HAL_OK) {
return false;
@@ -101,7 +102,7 @@ bool panel_init(display_driver_t *drv) {
// Write(Parameter , 0x00);
// Write(Parameter , 0x00);
// Write(Parameter , 0x10);
- ret = HAL_DSI_LongWrite(&drv->hlcd_dsi, 0, DSI_DCS_LONG_PKT_WRITE, 10, 0xFF,
+ ret = HAL_DSI_LongWrite(&drv->hlcd_dsi, 0, DSI_DCS_LONG_PKT_WRITE, 5, 0xFF,
(uint8_t[]){0x77, 0x01, 0x00, 0x00, 0x10});
if (ret != HAL_OK) {
return false;
@@ -198,7 +199,7 @@ bool panel_init(display_driver_t *drv) {
// Write(Parameter , 0x00);
// Write(Parameter , 0x00);
// Write(Parameter , 0x11);
- ret = HAL_DSI_LongWrite(&drv->hlcd_dsi, 0, DSI_DCS_LONG_PKT_WRITE, 10, 0xFF,
+ ret = HAL_DSI_LongWrite(&drv->hlcd_dsi, 0, DSI_DCS_LONG_PKT_WRITE, 5, 0xFF,
(uint8_t[]){0x77, 0x01, 0x00, 0x00, 0x11});
if (ret != HAL_OK) {
return false;
@@ -441,7 +442,7 @@ bool panel_init(display_driver_t *drv) {
// Write(Parameter , 0x00);
// Write(Parameter , 0x00);
ret =
- HAL_DSI_LongWrite(&drv->hlcd_dsi, 0, DSI_DCS_LONG_PKT_WRITE, 8, 0xEB,
+ HAL_DSI_LongWrite(&drv->hlcd_dsi, 0, DSI_DCS_LONG_PKT_WRITE, 7, 0xEB,
(uint8_t[]){0x02, 0x00, 0xE4, 0xE4, 0x88, 0x00, 0x00});
if (ret != HAL_OK) {
return false;
@@ -522,3 +523,4 @@ bool panel_init(display_driver_t *drv) {
return true;
}
+#endif
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.