fix(core): reorder linker script sections for stm32f4 firmware
What the developer wrote
Authored by cepetr
fix(core): reorder linker script sections for stm32f4 firmware
[no changelog]
What changed, and why it matters
This commit moves a special memory section named '.bootloader' from one flash memory region to another in the firmware's build instructions (the linker script). The bootloader section likely contains data used to verify or locate the device's bootloader. Reordering linker sections can affect how the firmware is laid out in memory, which in rare cases can have security implications (for example, if it changes what code runs first, where secrets live, or how integrity checks are computed). However, the commit message gives no explanation of why the change was needed or whether it fixes a security problem, and the diff alone does not show a clear vulnerability.
Treat as a routine build-layout fix unless Trezor publishes an advisory or follow-up commit explaining a security-relevant failure mode. Reviewers should verify that moving .bootloader out of FLASH2 does not break bootloader verification, downgrade protection, or fixed-address assumptions in the bootloader or boardloader. Ask the vendor whether this change is related to a security fix and request a changelog entry.
Security signals we found
Linker script change affecting .bootloader section placement
No changelog entry and minimal commit message
Potential memory-layout security implications if bootloader parameters are expected at a fixed address
No explicit security claim or CVE reference in commit
Evidence from the diff
The patch modifies core/embed/sys/linker/stm32f4/firmware.ld, moving the KEEP((.bootloader)) and (.bootloader*) directives from the .flash2 section (FLASH2 region) to the .flash section (FLASH region), and adds an ALIGN(512) boundary in .flash. This changes the placement of the .bootloader input section in the final firmware image. Without additional context, the diff does not demonstrate a memory corruption, bypass, or information leak. The change could be a correctness fix, a build-layout cleanup, or a prerequisite for a security property (e.g., ensuring the bootloader marker/params sit in the primary flash bank), but the commit message is silent on motivation.
Changed components
core/embed/sys/linker/stm32f4/firmware.ldTrezor Core firmware build for STM32F4Bootloader-related flash layoutInspect captured patch +3 / −3
### core/embed/sys/linker/stm32f4/firmware.ld
@@ -38,6 +38,9 @@ SECTIONS {
. = ALIGN(4);
*frozen_mpy.o(.rodata*);
. = ALIGN(4);
+ KEEP(*(.bootloader));
+ *(.bootloader*);
+ . = ALIGN(512);
} >FLASH AT>FLASH
.flash2 : ALIGN(512) {
@@ -46,9 +49,6 @@ SECTIONS {
. = ALIGN(4);
*(.rodata*);
. = ALIGN(4);
- KEEP(*(.bootloader));
- *(.bootloader*);
- . = ALIGN(512);
} >FLASH2 AT>FLASH2
.stack : ALIGN(8) {Why this scored 43/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.