What the developer wrote
Authored by cepetr
fix(core): fix storage migration
What changed, and why it matters
This commit fixes a firmware bug that could crash Trezor T3B1 and T3T1 devices during PIN verification when upgrading from firmware older than 2.9.0. The fix changes a build-time compiler flag condition so that a security feature ('-mcmse') is enabled on more device configurations, preventing the crash during storage migration.
Users with T3B1 or T3T1 devices should upgrade to a firmware release containing this fix before performing upgrades from firmware older than 2.9.0. Developers should verify that all secure-device build configurations correctly enable -mcmse and review storage migration tests for these models.
Security signals we found
Crash during PIN verification after firmware upgrade
Storage migration failure on affected devices
Compiler security flag condition expanded to cover additional build configurations
Device-specific fix limited to T3B1 and T3T1 models
Evidence from the diff
The change in core/embed/models/build.rs adjusts when the ARMv8-M ‘-mcmse’ compiler flag is added. Previously it was added only when the ‘secure_mode’ feature was enabled. Now it is also added when the ‘secmon_layout’ feature is disabled. The changelog states this fixes a crash during PIN verification on T3B1/T3T1 when upgrading from firmware versions older than 2.9.0, implying a storage migration path was affected by missing CMSE (Cortex-M Security Extensions) support in certain build configurations.
Changed components
core/embed/models/build.rsTrezor T3B1Trezor T3T1firmware upgrade / storage migration pathPIN verification flowInspect captured patch +2 / −1
diff --git a/core/.changelog.d/7354.fixed b/core/.changelog.d/7354.fixed
new file mode 100644
index 00000000..1ddb3075
--- /dev/null
+++ b/core/.changelog.d/7354.fixed
@@ -0,0 +1 @@
+[T3B1,T3T1] Fixed a crash during PIN verification when upgrading from firmware versions older than 2.9.0.
diff --git a/core/embed/models/build.rs b/core/embed/models/build.rs
index 32ce0c67..8a8f1c75 100644
--- a/core/embed/models/build.rs
+++ b/core/embed/models/build.rs
@@ -111,7 +111,7 @@ fn main() -> Result<()> {
"-mtune=cortex-m33",
]);
- if cfg!(feature = "secure_mode") {
+ if cfg!(feature = "secure_mode") || !cfg!(feature = "secmon_layout") {
lib.add_flag("-mcmse");
}
} else {
Why this scored 51/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.