From b5053d9f6ee89719566ab8647c0a8a45ab254ec1 Mon Sep 17 00:00:00 2001
From: cepetr <60569462+cepetr@users.noreply.github.com>
Date: Tue, 11 Mar 2025 07:58:57 +0100
Subject: [PATCH] fix(core): add kernel access to assets by default (#4759)

[no changelog]
---
 core/embed/sys/mpu/stm32f4/mpu.c | 5 ++++-
 core/embed/sys/mpu/stm32u5/mpu.c | 7 ++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/core/embed/sys/mpu/stm32f4/mpu.c b/core/embed/sys/mpu/stm32f4/mpu.c
index 8ac86bdb3c..fbfba16e16 100644
--- a/core/embed/sys/mpu/stm32f4/mpu.c
+++ b/core/embed/sys/mpu/stm32f4/mpu.c
@@ -353,7 +353,10 @@ mpu_mode_t mpu_reconfig(mpu_mode_t mode) {
 
     default:
       DIS_REGION( 5 );
-      DIS_REGION( 6 );
+      // Assets (Privileged, Read-Only, Non-Executable)
+      // Subregion: 32KB = 64KB except 2/8 at start and 2/8 at end
+      // By default, the kernel needs to have the same access to assets as the app
+      SET_REGION( 6, FLASH_BASE + 0x104000, SIZE_64KB, 0xC3, FLASH_DATA, PRIV_RO );
       break;
   }
   // clang-format on
diff --git a/core/embed/sys/mpu/stm32u5/mpu.c b/core/embed/sys/mpu/stm32u5/mpu.c
index ed4ae8f693..1f61e62169 100644
--- a/core/embed/sys/mpu/stm32u5/mpu.c
+++ b/core/embed/sys/mpu/stm32u5/mpu.c
@@ -193,7 +193,7 @@ static inline void mpu_enable(void) {
 }
 
 static void mpu_init_fixed_regions(void) {
-  // Regions #0 to #5 are fixed for all targets
+  // Regions #0 to #4 are fixed for all targets
 
   // clang-format off
 #if defined(BOARDLOADER)
@@ -240,7 +240,7 @@ static void mpu_init_fixed_regions(void) {
   SET_REGION( 4, AUX1_RAM_START,           AUX1_RAM_SIZE,     SRAM,        YES,    NO );
 #endif
 
-  // Regions #6 and #7 are banked
+  // Regions #5 to #7 are banked
 
   DIS_REGION( 5 );
   DIS_REGION( 6 );
@@ -389,7 +389,8 @@ mpu_mode_t mpu_reconfig(mpu_mode_t mode) {
       SET_REGION( 6, BOOTARGS_START,           BOOTARGS_SIZE,      SRAM,        YES,    NO );
       break;
     default:
-      DIS_REGION( 6 );
+      // By default, the kernel needs to have the same access to assets as the app
+      SET_REGION( 6, ASSETS_START,             ASSETS_MAXSIZE,     FLASH_DATA,   NO,    NO );
       break;
   }
   // clang-format on