Disallow RTT in BitBox03 production builds
What the developer wrote
Authored by Niklas Dusenlund
Disallow RTT in BitBox03 production builds
Mark release boot0, boot1, and firmware links as production. Reject RTT control block or buffer sections from those final ELF files.
What changed, and why it matters
This change makes sure that production versions of the BitBox03 hardware wallet do not include SEGGER RTT (Real-Time Transfer) debug sections. RTT is a debugging feature that lets a connected computer exchange data with the device while it runs. In a production device, leaving those debug sections linked into the final firmware could give an attacker with physical access an extra channel to read memory or interact with the device. The patch marks release builds as 'production' and makes the linker throw an error if any RTT control or buffer sections are still present.
Verify that release CI builds fail as expected when RTT sections are accidentally included, and confirm that debug builds still allow RTT for development. No immediate user action is required.
Security signals we found
Prevents debug/RTT sections in production firmware
Adds build-time linker assertion for production builds
Applies to boot0, boot1, and firmware release images
Reduces physical-access attack surface by removing a debug channel
Evidence from the diff
The commit adds a linker-defined symbol __bitbox03_production=1 for release builds of boot0, boot1, and firmware. The common linker script bitbox03-common.ld then asserts that when __bitbox03_production is defined, the .segger_rtt and .segger_rtt_buf sections must have zero size. If they are present, the link fails. This is a build-time enforcement meant to prevent RTT debug buffers from being shipped in production firmware.
Changed components
bitbox03-boot0 release buildbitbox03-boot1 release buildbitbox03-firmware release buildbitbox03-common.ld linker scriptInspect captured patch +13 / −0
### src/rust/bins/bitbox03-boot0/build.rs
@@ -22,5 +22,8 @@ fn main() {
out_dir.join("bitbox03-boot0.map").display()
);
println!("cargo::rustc-link-arg=-Tbitbox03-boot0.ld");
+ if std::env::var("PROFILE").expect("PROFILE not set") == "release" {
+ println!("cargo::rustc-link-arg=--defsym=__bitbox03_production=1");
+ }
}
}
### src/rust/bins/bitbox03-boot1/build.rs
@@ -74,5 +74,8 @@ fn main() {
"cargo::rustc-link-arg=-Map={}",
out_dir.join("bitbox03-boot1.map").display()
);
+ if std::env::var("PROFILE").expect("PROFILE not set") == "release" {
+ println!("cargo::rustc-link-arg=--defsym=__bitbox03_production=1");
+ }
}
}
### src/rust/bins/bitbox03-firmware/build.rs
@@ -77,6 +77,9 @@ fn main() {
out_dir.join("bitbox03-firmware.map").display()
);
println!("cargo::rustc-link-arg=-Tbitbox03-firmware.ld");
+ if std::env::var("PROFILE").expect("PROFILE not set") == "release" {
+ println!("cargo::rustc-link-arg=--defsym=__bitbox03_production=1");
+ }
#[cfg(feature = "board-stm32u5a9j-dk")]
build_hal_overrides_object(&repo_root, &out_dir);
### src/rust/bitbox-platform-stm32u5/bitbox03-common.ld
@@ -316,6 +316,10 @@ Set _stext to an address within the FLASH region.");
ASSERT(SIZEOF(.segger_rtt) + SIZEOF(.segger_rtt_buf) <= 4K, "
ERROR(bitbox03): RTT sections do not fit into the reserved RTT window.");
+ASSERT(!DEFINED(__bitbox03_production) ||
+ (SIZEOF(.segger_rtt) == 0 && SIZEOF(.segger_rtt_buf) == 0), "
+ERROR(bitbox03): RTT sections must not be linked into production builds.");
+
/* # Other checks */
ASSERT(SIZEOF(.got) == 0, "
ERROR(cortex-m-rt): .got section detected in the input object filesWhy this scored 47/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.