fix(core): remove unused MPU modes from the kernel
What the developer wrote
Authored by cepetr
fix(core): remove unused MPU modes from the kernel
[no changelog]
What changed, and why it matters
This commit removes a memory-protection setting that was being compiled into the Trezor's core kernel even though it was not supposed to be used there. The setting controls access to a special flash area called BOOTUCB, which is related to boot configuration. By making sure this MPU mode is only available outside the kernel, the change prevents the kernel from accidentally or maliciously reconfiguring memory protections to expose or alter sensitive boot-configuration storage. The actual risk is limited because the mode was described as unused in the kernel, and the patch is a one-line guard.
Treat as a minor hardening/cleanup commit. Review whether any kernel code path could previously invoke mpu_reconfig(MPU_MODE_BOOTUCB) and confirm the guard is sufficient. No urgent user action is indicated by the diff alone.
Security signals we found
Memory Protection Unit (MPU) reconfiguration case restricted to non-kernel builds
BOOTUCB flash region mapping removed from kernel MPU mode table
Commit message frames change as removal of unused kernel MPU modes
Single-line conditional compilation change with no functional code alteration
No changelog entry, indicating low-severity maintenance fix
Evidence from the diff
In core/embed/sys/mpu/stm32u5/mpu.c, the mpu_reconfig() switch case for MPU_MODE_BOOTUCB is now guarded by both USE_BOOT_UCB and !KERNEL. Previously it was available whenever USE_BOOT_UCB was defined, including in the kernel build. The commit message says this removes unused MPU modes from the kernel. The change prevents kernel code from selecting MPU_MODE_BOOTUCB, which would map the BOOTUCB flash region (boot user configuration block) with FLASH_DATA attributes and read access. This is a hardening/cleanup change rather than a fix for an active exploit path.
Changed components
Trezor core firmwarecore/embed/sys/mpu/stm32u5/mpu.cMPU reconfiguration logic for STM32U5BOOTUCB memory region handlingInspect captured patch +1 / −1
diff --git a/core/embed/sys/mpu/stm32u5/mpu.c b/core/embed/sys/mpu/stm32u5/mpu.c
index 6a0a80fe..5d9f5faa 100644
--- a/core/embed/sys/mpu/stm32u5/mpu.c
+++ b/core/embed/sys/mpu/stm32u5/mpu.c
@@ -490,7 +490,7 @@ mpu_mode_t mpu_reconfig(mpu_mode_t mode) {
case MPU_MODE_BOOTARGS:
SET_REGION( 6, BOOTARGS_START, BOOTARGS_SIZE, SRAM, YES, NO );
break;
-#ifdef USE_BOOT_UCB
+#if defined(USE_BOOT_UCB) && !defined(KERNEL)
case MPU_MODE_BOOTUCB:
SET_REGION( 6, BOOTUCB_START, BOOTUCB_MAXSIZE, FLASH_DATA, YES, NO );
break;
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.