What the developer wrote
Authored by cepetr
fix(core): fix fw hash calculation
[no changelog]
What changed, and why it matters
This commit fixes an off-by-one error in the STM32U5 flash memory layout definition for Trezor's hardware wallet firmware. The number of sectors covering the kernel/firmware area was calculated as one too few, meaning the last sector was excluded from the area used for firmware hash verification. This could cause the device to compute or verify a firmware hash that does not cover the entire installed firmware image, potentially weakening integrity checks.
Treat as a security-relevant correctness fix. Verify that the corrected sector range now matches the actual firmware layout and that firmware hash verification covers the full image. Review whether any prior firmware releases shipped with hashes computed over the truncated range, and consider whether a security advisory or changelog entry is warranted despite the [no changelog] tag.
Security signals we found
Off-by-one sector range error in flash memory layout
Firmware integrity hash may not cover full firmware image
Last firmware sector excluded from hash/verification region
Fix explicitly tied to 'fw hash calculation' by commit author
Evidence from the diff
In core/embed/util/flash/stm32u5/flash.c, the subarea covering kernel/firmware sectors was defined with num_sectors = FIRMWARE_SECTOR_END - KERNEL_SECTOR_START - 1. Because sector ranges are typically inclusive, this omitted the final sector. The patch changes the formula to +1, making the subarea cover the full intended range. The commit title states this fixes firmware hash calculation, implying the hash function iterates over these subareas and previously skipped the last sector.
Changed components
core/embed/util/flash/stm32u5/flash.cSTM32U5 flash driver subarea definitionFirmware hash calculation / verification pathInspect captured patch +1 / −1
diff --git a/core/embed/util/flash/stm32u5/flash.c b/core/embed/util/flash/stm32u5/flash.c
index 0cc442bf4..1f1536fc1 100644
--- a/core/embed/util/flash/stm32u5/flash.c
+++ b/core/embed/util/flash/stm32u5/flash.c
@@ -60,7 +60,7 @@ void flash_init(void) {
.subarea[1] =
{
.first_sector = KERNEL_SECTOR_START,
- .num_sectors = FIRMWARE_SECTOR_END - KERNEL_SECTOR_START - 1,
+ .num_sectors = FIRMWARE_SECTOR_END - KERNEL_SECTOR_START + 1,
},
};
#endif
Why this scored 57/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.