feat(core): use ecc sram in bootloader/boardloader

Trezor/Trezor firmware

0cac085e View source ↗

Public commit record

What the developer wrote

Authored by cepetr

62/100 · Adequate

feat(core): use ecc sram in bootloader/boardloader

[no changelog]

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit changes how the Trezor hardware wallet's earliest startup code (boardloader and bootloader) uses internal memory on the T3B1 model. It shifts small data and uninitialized-memory sections from one RAM bank (AUX1_RAM) to another (MAIN_RAM), and slightly adjusts the size and start addresses of those RAM regions. The title says this is to 'use ECC SRAM'—memory with built-in error-correction, which is a reliability/hardening improvement, not a vulnerability fix. There is no direct evidence in the commit of a security bug being patched.

Recommended action

Treat as a hardening/layout change rather than a security fix. Review that MAIN_RAM is large enough for combined boardloader/bootloader .data/.bss plus stack/heap needs, and that ECC is actually enabled for MAIN_RAM in the SoC configuration. No urgent user action is indicated.

Security signals we found

Memory layout change in security-sensitive boot stages (boardloader/bootloader)

Use of ECC SRAM suggests hardening against fault attacks / bit flips

No changelog entry provided

No explicit bug, bounds issue, or vulnerability described in commit

Technical analysis

Evidence from the diff

The patch modifies memory layout headers and linker scripts for the STM32U5-based T3B1. MAIN_RAM is expanded from 24 KiB to 32 KiB, and AUX2_RAM is shifted up and shrunk by the same 8 KiB. The boardloader and bootloader linker scripts now place .data and .bss into MAIN_RAM instead of AUX1_RAM. The stated goal is to use ECC-protected SRAM in the bootloader/boardloader. The diff is purely a memory-map relocation; no code logic, bounds checks, or access controls are changed. No security relevance, CVE, or researcher attribution is mentioned.

Changed components

Trezor T3B1 boardloader linker script (stm32u58, stm32u5g)Trezor T3B1 bootloader linker script (stm32u58, stm32u5g)Trezor T3B1 memory layout header (memory.h)Trezor T3B1 memory layout linker include (memory.ld)

Inspect captured patch +14 / −14

diff --git a/core/embed/models/T3B1/memory.h b/core/embed/models/T3B1/memory.h
index 04b10613..82aa3f6c 100644
--- a/core/embed/models/T3B1/memory.h
+++ b/core/embed/models/T3B1/memory.h
@@ -78,10 +78,10 @@
 #define BOOTARGS_SIZE 0x100
 
 #define MAIN_RAM_START 0x30030000
-#define MAIN_RAM_SIZE (24 * 1024)
+#define MAIN_RAM_SIZE (32 * 1024)
 
-#define AUX2_RAM_START 0x30036000
-#define AUX2_RAM_SIZE (544 * 1024)
+#define AUX2_RAM_START 0x30038000
+#define AUX2_RAM_SIZE (536 * 1024)
 
 #define FB1_RAM_START 0x300BE000
 #define FB1_RAM_SIZE (0x2000)
diff --git a/core/embed/models/T3B1/memory.ld b/core/embed/models/T3B1/memory.ld
index 4a7c319d..a172fd36 100644
--- a/core/embed/models/T3B1/memory.ld
+++ b/core/embed/models/T3B1/memory.ld
@@ -40,9 +40,9 @@ AUX1_RAM_SIZE = 0x2fe00;
 BOOTARGS_START = 0x3002ff00;
 BOOTARGS_SIZE = 0x100;
 MAIN_RAM_START = 0x30030000;
-MAIN_RAM_SIZE = 0x6000;
-AUX2_RAM_START = 0x30036000;
-AUX2_RAM_SIZE = 0x88000;
+MAIN_RAM_SIZE = 0x8000;
+AUX2_RAM_START = 0x30038000;
+AUX2_RAM_SIZE = 0x86000;
 FB1_RAM_START = 0x300be000;
 FB1_RAM_SIZE = 0x2000;
 FB2_RAM_START = 0x300c0000;
diff --git a/core/embed/sys/linker/stm32u58/boardloader.ld b/core/embed/sys/linker/stm32u58/boardloader.ld
index f8acfe71..13d62fe7 100644
--- a/core/embed/sys/linker/stm32u58/boardloader.ld
+++ b/core/embed/sys/linker/stm32u58/boardloader.ld
@@ -42,7 +42,7 @@ SECTIONS {
   .data : ALIGN(4) {
     *(.data*);
     . = ALIGN(8);
-  } >AUX1_RAM AT>FLASH
+  } >MAIN_RAM AT>FLASH
 
   /DISCARD/ : {
     *(.ARM.exidx*);
@@ -51,7 +51,7 @@ SECTIONS {
   .bss : ALIGN(4) {
     *(.bss*);
     . = ALIGN(4);
-  } >AUX1_RAM
+  } >MAIN_RAM
 
   .buf : ALIGN(4) {
     *(.buf*);
diff --git a/core/embed/sys/linker/stm32u58/bootloader.ld b/core/embed/sys/linker/stm32u58/bootloader.ld
index 455d31f4..04a23932 100644
--- a/core/embed/sys/linker/stm32u58/bootloader.ld
+++ b/core/embed/sys/linker/stm32u58/bootloader.ld
@@ -42,7 +42,7 @@ SECTIONS {
   .data : ALIGN(4) {
     *(.data*);
     . = ALIGN(512);
-  } >AUX1_RAM AT>FLASH
+  } >MAIN_RAM AT>FLASH
 
   /DISCARD/ : {
     *(.ARM.exidx*);
@@ -51,7 +51,7 @@ SECTIONS {
   .bss : ALIGN(4) {
     *(.bss*);
     . = ALIGN(4);
-  } >AUX1_RAM
+  } >MAIN_RAM
 
   .buf : ALIGN(4) {
     *(.buf*);
diff --git a/core/embed/sys/linker/stm32u5g/boardloader.ld b/core/embed/sys/linker/stm32u5g/boardloader.ld
index d48bfe38..1dcd5619 100644
--- a/core/embed/sys/linker/stm32u5g/boardloader.ld
+++ b/core/embed/sys/linker/stm32u5g/boardloader.ld
@@ -43,7 +43,7 @@ SECTIONS {
   .data : ALIGN(4) {
     *(.data*);
     . = ALIGN(8);
-  } >AUX1_RAM AT>FLASH
+  } >MAIN_RAM AT>FLASH
 
   /DISCARD/ : {
     *(.ARM.exidx*);
@@ -52,7 +52,7 @@ SECTIONS {
   .bss : ALIGN(4) {
     *(.bss*);
     . = ALIGN(4);
-  } >AUX1_RAM
+  } >MAIN_RAM
 
   .buf : ALIGN(4) {
     *(.buf*);
diff --git a/core/embed/sys/linker/stm32u5g/bootloader.ld b/core/embed/sys/linker/stm32u5g/bootloader.ld
index f64643d9..e66dfdc0 100644
--- a/core/embed/sys/linker/stm32u5g/bootloader.ld
+++ b/core/embed/sys/linker/stm32u5g/bootloader.ld
@@ -46,7 +46,7 @@ SECTIONS {
   .data : ALIGN(4) {
     *(.data*);
     . = ALIGN(512);
-  } >AUX1_RAM AT>FLASH
+  } >MAIN_RAM AT>FLASH
 
   /DISCARD/ : {
     *(.ARM.exidx*);
@@ -55,7 +55,7 @@ SECTIONS {
   .bss : ALIGN(4) {
     *(.bss*);
     . = ALIGN(4);
-  } >AUX1_RAM
+  } >MAIN_RAM
 
   .buf : ALIGN(4) {
     *(.buf*);

Risk score

Why this scored 11/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 2/15

Confidence 3/10

Evidence quality 2/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 11/100

Community notes

Related watches

fix(python/trezorlib): enable entropy check on T1 by default

chore(core): remove scons related files

refactor(core): assorted micropython-1.28.0 fixes