feat(core): add support for PQ uild on STM32U58x
What the developer wrote
Authored by tychovrahe
feat(core): add support for PQ uild on STM32U58x
[no changelog]
What changed, and why it matters
This commit updates a bootloader linker script for a new STM32U58-based Trezor variant to support an alternative 'PQ' (post-quantum) bootloader header format. It adds a code-size symbol, a small padding section, and changes how the bootloader image is padded to its maximum size. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a build/enablement change for a new hardware configuration.
Treat as a normal feature/build enablement commit. If auditing, verify that _bootloader_code_size and BOOTLOADER_MAXSIZE correctly account for header and padding sizes so the PQ header's length field does not underreport or overreport the protected code region, which could affect signature verification or firmware-update checks.
Security signals we found
Linker script change affecting bootloader image layout and header formats
New symbol _bootloader_code_size used by PQ (boot_ucb) header
Padding strategy changed from ALIGN(512) to BOOTLOADER_MAXSIZE boundary
Evidence from the diff
The diff modifies core/embed/sys/linker/stm32u58/bootloader.ld. It introduces _bootloader_code_size for the PQ (boot_ucb) header while keeping _codelen for the classic header.S, adds a .padding section aligned to CODE_ALIGNMENT, removes redundant AT>FLASH directives, and changes the final .flash padding block to terminate at ADDR(.header) + BOOTLOADER_MAXSIZE instead of aligning to 512 bytes. The change is architectural: one linker script now serves both classic and PQ bootloader headers. No bug, overflow, or vulnerability is directly described or obviously present in the diff.
Changed components
core/embed/sys/linker/stm32u58/bootloader.ldTrezor Core bootloader build for STM32U58xInspect captured patch +13 / −5
diff --git a/core/embed/sys/linker/stm32u58/bootloader.ld b/core/embed/sys/linker/stm32u58/bootloader.ld
index 5ea8a9e5..c614e507 100644
--- a/core/embed/sys/linker/stm32u58/bootloader.ld
+++ b/core/embed/sys/linker/stm32u58/bootloader.ld
@@ -22,12 +22,21 @@ _bss_section_end = ADDR(.bss) + SIZEOF(.bss);
_bootargs_ram_start = BOOTARGS_START;
_bootargs_ram_end = BOOTARGS_START + BOOTARGS_SIZE;
+/* _bootloader_code_size is used by the PQ (boot_ucb) header; _codelen is used
+ by the classic header.S. Both are defined so this single script serves both
+ bootloader header formats. */
+_bootloader_code_size = _bootloader_code_end - ADDR(.padding);
_codelen = _bootloader_code_end - ADDR(.flash);
SECTIONS {
.header : ALIGN(4) {
KEEP(*(.header));
- } >FLASH AT>FLASH
+ } >FLASH
+
+ .padding : ALIGN(4) {
+ . = ALIGN(4);
+ . = ALIGN(CODE_ALIGNMENT);
+ } >FLASH
.flash : ALIGN(CODE_ALIGNMENT) {
KEEP(*(.vector_table));
@@ -36,7 +45,7 @@ SECTIONS {
. = ALIGN(4);
*(.rodata*);
. = ALIGN(4);
- } >FLASH AT>FLASH
+ } >FLASH
.data : ALIGN(4) {
*(.data*);
@@ -80,12 +89,11 @@ SECTIONS {
. = ALIGN(8);
} >BOOT_ARGS
- .flash : ALIGN(4) {
+ .flash : {
/* Pad the rest of bootloader area with zeros */
BYTE(0x00)
FILL(0x00)
- /* Use alignment required by the boardloader */
- . = ALIGN(512);
+ . = ADDR(.header) + BOOTLOADER_MAXSIZE;
_bootloader_code_end = .;
} >FLASH
}
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.