refactor(core): update t2t1 firmware layout for rlib linking
What the developer wrote
Authored by cepetr
refactor(core): update t2t1 firmware layout for rlib linking
[no changelog]
What changed, and why it matters
This commit rearranges how different pieces of the Trezor firmware are placed in the device's flash memory. It moves frozen Python data and the main code sections into one flash region, while moving the bootloader into a separate flash region. The stated purpose is to support linking Rust static libraries (rlib). There is no direct evidence in the commit that this fixes a security vulnerability.
Treat as a routine build/layout refactor. If reviewing for security, verify that moving the bootloader to FLASH2 does not bypass existing memory protection assumptions, and that the new layout preserves intended isolation between bootloader, kernel, coreapp, and application code. No immediate security action is indicated by this commit alone.
Security signals we found
Linker script modification changes memory region assignments
Bootloader moved to separate FLASH2 region
No explicit security context in commit message or diff
No changelog entry suggests routine refactor
Evidence from the diff
The linker script change refactors the STM32F4 firmware memory layout. Previously, .flash contained kernel, coreapp header, text/rodata, and bootloader all in FLASH. The .flash2 section contained frozen_mpy.o rodata and libtrezor_lib.a text/rodata in FLASH2. The change moves frozen_mpy.o rodata and all .text/.rodata into .flash (FLASH), while moving the bootloader into .flash2 (FLASH2). This appears to be a build-system/layout change to accommodate rlib linking, not a security patch.
Changed components
core/embed/sys/linker/stm32f4/firmware.ldTrezor Model T (t2t1) firmware memory layoutBootloader flash placementFrozen MicroPython data placementInspect captured patch +7 / −10
diff --git a/core/embed/sys/linker/stm32f4/firmware.ld b/core/embed/sys/linker/stm32f4/firmware.ld
index dac9be08..c17d3d18 100644
--- a/core/embed/sys/linker/stm32f4/firmware.ld
+++ b/core/embed/sys/linker/stm32f4/firmware.ld
@@ -31,19 +31,16 @@ SECTIONS {
KEEP(*(.header));
} >FLASH AT>FLASH
- .flash2 : ALIGN(CODE_ALIGNMENT) {
- build/firmware/frozen_mpy.o(.rodata*);
- . = ALIGN(4);
- */libtrezor_lib.a:(.text*);
- . = ALIGN(4);
- */libtrezor_lib.a:(.rodata*);
- . = ALIGN(512);
- } >FLASH2 AT>FLASH2
-
.flash : ALIGN(512) {
KEEP(*(.kernel));
. = ALIGN(COREAPP_ALIGNMENT);
KEEP(*(.coreapp_header));
+ . = ALIGN(4);
+ *frozen_mpy.o(.rodata*);
+ . = ALIGN(4);
+ } >FLASH AT>FLASH
+
+ .flash2 : ALIGN(512) {
. = ALIGN(4);
*(.text*);
. = ALIGN(4);
@@ -52,7 +49,7 @@ SECTIONS {
KEEP(*(.bootloader));
*(.bootloader*);
. = ALIGN(512);
- } >FLASH AT>FLASH
+ } >FLASH2 AT>FLASH2
.stack : ALIGN(8) {
. += 16K; /* Exactly 16K allocated for stack. Overflow causes MemManage fault (when using MPU). */
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.