fix(core): fix secmon/bootloader padding
What the developer wrote
Authored by cepetr
fix(core): fix secmon/bootloader padding
[no changelog]
What changed, and why it matters
This commit adjusts linker scripts that control how the Trezor hardware wallet's bootloader and security monitor (secmon) binary images are laid out in flash memory. It reduces alignment padding from 512 bytes to 4 bytes and changes how unused space at the end of each image is filled with zeros. The change appears to be a correctness fix for image padding rather than a fix for an exploitable memory corruption bug, but the exact security implications are not stated by the vendor.
Treat as a routine build/linker correctness fix. Review the resulting binary images to confirm the bootloader and secmon images now end exactly at their declared maximum boundaries and that no unintended gaps or overlaps are introduced. If this commit is part of a security release, wait for vendor release notes or advisory before assigning higher risk.
Security signals we found
Linker script changes affecting bootloader and security monitor image layout
Alignment reduction from 512 bytes to 4 bytes in flash and RAM sections
Padding logic rewritten to use explicit FILL and exact boundary symbol
No changelog entry provided, limiting vendor context
No explicit security advisory, CVE, or researcher attribution in commit
Evidence from the diff
The patch modifies two STM32U5G linker scripts: bootloader.ld and secmon.ld. It changes section alignment from ALIGN(512) to ALIGN(4) for .text/.rodata and .data sections, and rewrites the terminal padding logic. Previously the padding block set the location counter to (boundary - 1), emitted one zero byte, and then relied on implicit fill. Now it explicitly emits FILL(0x00), sets the counter to the exact boundary, and defines the end symbol. This likely fixes a case where the image was one byte short of the intended boundary or where padding was inconsistent. There is no direct evidence in the diff of a vulnerability such as buffer overflow, code execution, or bypass; the change is structural/correctness.
Changed components
core/embed/sys/linker/stm32u5g/bootloader.ldcore/embed/sys/linker/stm32u5g/secmon.ldTrezor Core bootloader image layoutTrezor Core security monitor (secmon) image layoutInspect captured patch +8 / −6
diff --git a/core/embed/sys/linker/stm32u5g/bootloader.ld b/core/embed/sys/linker/stm32u5g/bootloader.ld
index e66dfdc0..e11a9fe5 100644
--- a/core/embed/sys/linker/stm32u5g/bootloader.ld
+++ b/core/embed/sys/linker/stm32u5g/bootloader.ld
@@ -40,12 +40,12 @@ SECTIONS {
*(.text*);
. = ALIGN(4);
*(.rodata*);
- . = ALIGN(512);
+ . = ALIGN(4);
} >FLASH
.data : ALIGN(4) {
*(.data*);
- . = ALIGN(512);
+ . = ALIGN(4);
} >MAIN_RAM AT>FLASH
/DISCARD/ : {
@@ -87,8 +87,9 @@ SECTIONS {
.flash : {
/* Pad the rest of bootloader area with zeros */
- . = ADDR(.header) + BOOTLOADER_MAXSIZE - 1;
BYTE(0x00)
+ FILL(0x00)
+ . = ADDR(.header) + BOOTLOADER_MAXSIZE;
_bootloader_code_end = .;
} >FLASH
}
diff --git a/core/embed/sys/linker/stm32u5g/secmon.ld b/core/embed/sys/linker/stm32u5g/secmon.ld
index 713644a6..6d1927bc 100644
--- a/core/embed/sys/linker/stm32u5g/secmon.ld
+++ b/core/embed/sys/linker/stm32u5g/secmon.ld
@@ -61,7 +61,7 @@ SECTIONS {
*(.text*);
. = ALIGN(4);
*(.rodata*);
- . = ALIGN(512);
+ . = ALIGN(4);
} >FLASH
.stack : ALIGN(8) {
@@ -70,7 +70,7 @@ SECTIONS {
.data : ALIGN(4) {
*(.data*);
- . = ALIGN(512);
+ . = ALIGN(4);
} >RAM AT>FLASH
.bss : ALIGN(4) {
@@ -100,8 +100,9 @@ SECTIONS {
}
.flash : {
- . = ALIGN(8K) - 1;
BYTE(0x00)
+ FILL(0x00)
+ . = ALIGN(8K);
_secmon_flash_end = .;
} >FLASH
}
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.