fix(core): increase stack size on F4 models

Trezor/Trezor firmware

0c49e9e8 View source ↗

Public commit record

What the developer wrote

Authored by tychovrahe

57/100 · Thin

fix(core): increase stack size on F4 models

[no changelog]

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit increases the kernel's main stack size from 8 KB to 10 KB on several Trezor hardware wallet models that use STM32F4 microcontrollers. To make room, it slightly shrinks a separate auxiliary RAM region (AUX2). The change is a defensive hardening fix: a stack that is too small can overflow, which on these devices triggers a memory-protection fault and may crash or reset the device. The commit itself does not describe a specific attack, but insufficient stack space is a known reliability and security concern in embedded systems.

Recommended action

Treat as a hardening/reliability improvement rather than a confirmed vulnerability. If deploying or auditing this firmware, verify that the new stack size is sufficient for worst-case call depth and interrupt nesting, and that shrinking AUX2 does not break any application that relies on it. Monitor future commits and release notes for any related security advisory.

Security signals we found

Stack-size increase on a security-critical embedded device

Explicit linker comment that stack overflow causes MemManage fault under MPU

Auxiliary RAM region shrunk to accommodate larger stack, indicating a deliberate layout trade-off

No changelog entry, limiting public context

Technical analysis

Evidence from the diff

The patch updates memory layout headers and linker scripts for D001, T2B1, and T2T1 models, plus the shared stm32f4 kernel linker script. K_MAIN_STACK_SIZE is raised from 8 KiB (0x2000) to 10 KiB (0x2800), and the AUX2_RAM region is moved forward and reduced by 2 KiB to keep the overall layout consistent. The linker comment explicitly notes that stack overflow causes a MemManage fault when the MPU is enabled. No functional code changes are present; this is purely a memory-map adjustment.

Changed components

Trezor Core firmware memory layout for STM32F4 modelsD001, T2B1, T2T1 device memory mapsKernel main stack allocationAUX2 RAM region allocation

Inspect captured patch +19 / −19

diff --git a/core/embed/models/D001/memory.h b/core/embed/models/D001/memory.h
index f56ba7eb..cba89e4e 100644
--- a/core/embed/models/D001/memory.h
+++ b/core/embed/models/D001/memory.h
@@ -87,7 +87,7 @@
 
 // RAM layout - kernel
 #define K_MAIN_STACK_START 0x10000000
-#define K_MAIN_STACK_SIZE (8 * 1024)
+#define K_MAIN_STACK_SIZE (10 * 1024)
 
 #define K_FB1_RAM_START 0x1000C000
 #define K_FB1_RAM_SIZE (0)
@@ -105,8 +105,8 @@
 #define AUX1_RAM_START (0x20000400)
 #define AUX1_RAM_SIZE (191 * 1024)
 
-#define AUX2_RAM_START 0x10002000
-#define AUX2_RAM_SIZE (40 * 1024)
+#define AUX2_RAM_START 0x10002800
+#define AUX2_RAM_SIZE (38 * 1024)
 
 // misc
 #define CODE_ALIGNMENT 0x200
diff --git a/core/embed/models/D001/memory.ld b/core/embed/models/D001/memory.ld
index eacdc924..b1c103b3 100644
--- a/core/embed/models/D001/memory.ld
+++ b/core/embed/models/D001/memory.ld
@@ -48,7 +48,7 @@ S_FB1_RAM_SIZE = 0x0;
 S_MAIN_RAM_START = 0x10004000;
 S_MAIN_RAM_SIZE = 0xbf00;
 K_MAIN_STACK_START = 0x10000000;
-K_MAIN_STACK_SIZE = 0x2000;
+K_MAIN_STACK_SIZE = 0x2800;
 K_FB1_RAM_START = 0x1000c000;
 K_FB1_RAM_SIZE = 0x0;
 K_MAIN_RAM_START = 0x1000c000;
@@ -59,7 +59,7 @@ DMABUF_RAM_START = 0x20000000;
 DMABUF_RAM_SIZE = 0x400;
 AUX1_RAM_START = 0x20000400;
 AUX1_RAM_SIZE = 0x2fc00;
-AUX2_RAM_START = 0x10002000;
-AUX2_RAM_SIZE = 0xa000;
+AUX2_RAM_START = 0x10002800;
+AUX2_RAM_SIZE = 0x9800;
 CODE_ALIGNMENT = 0x200;
 COREAPP_ALIGNMENT = 0x200;
diff --git a/core/embed/models/T2B1/memory.h b/core/embed/models/T2B1/memory.h
index e0600780..77e4bd5e 100644
--- a/core/embed/models/T2B1/memory.h
+++ b/core/embed/models/T2B1/memory.h
@@ -93,7 +93,7 @@
 
 // RAM layout - kernel
 #define K_MAIN_STACK_START 0x10000000
-#define K_MAIN_STACK_SIZE (8 * 1024)
+#define K_MAIN_STACK_SIZE (10 * 1024)
 
 #define K_FB1_RAM_START 0x1000A000
 #define K_FB1_RAM_SIZE (8 * 1024)
@@ -111,8 +111,8 @@
 #define AUX1_RAM_START (0x20000400)
 #define AUX1_RAM_SIZE (191 * 1024)
 
-#define AUX2_RAM_START 0x10002000
-#define AUX2_RAM_SIZE (32 * 1024)
+#define AUX2_RAM_START 0x10002800
+#define AUX2_RAM_SIZE (30 * 1024)
 
 // misc
 #define CODE_ALIGNMENT 0x200
diff --git a/core/embed/models/T2B1/memory.ld b/core/embed/models/T2B1/memory.ld
index 7d514dd8..0b473221 100644
--- a/core/embed/models/T2B1/memory.ld
+++ b/core/embed/models/T2B1/memory.ld
@@ -53,7 +53,7 @@ S_FB1_RAM_SIZE = 0x2000;
 S_MAIN_RAM_START = 0x10006000;
 S_MAIN_RAM_SIZE = 0x9f00;
 K_MAIN_STACK_START = 0x10000000;
-K_MAIN_STACK_SIZE = 0x2000;
+K_MAIN_STACK_SIZE = 0x2800;
 K_FB1_RAM_START = 0x1000a000;
 K_FB1_RAM_SIZE = 0x2000;
 K_MAIN_RAM_START = 0x1000c000;
@@ -64,7 +64,7 @@ DMABUF_RAM_START = 0x20000000;
 DMABUF_RAM_SIZE = 0x400;
 AUX1_RAM_START = 0x20000400;
 AUX1_RAM_SIZE = 0x2fc00;
-AUX2_RAM_START = 0x10002000;
-AUX2_RAM_SIZE = 0x8000;
+AUX2_RAM_START = 0x10002800;
+AUX2_RAM_SIZE = 0x7800;
 CODE_ALIGNMENT = 0x200;
 COREAPP_ALIGNMENT = 0x200;
diff --git a/core/embed/models/T2T1/memory.h b/core/embed/models/T2T1/memory.h
index e758a388..6f156356 100644
--- a/core/embed/models/T2T1/memory.h
+++ b/core/embed/models/T2T1/memory.h
@@ -88,7 +88,7 @@
 
 // RAM layout - kernel
 #define K_MAIN_STACK_START 0x10000000
-#define K_MAIN_STACK_SIZE (8 * 1024)
+#define K_MAIN_STACK_SIZE (10 * 1024)
 
 #define K_FB1_RAM_START 0x1000C000
 #define K_FB1_RAM_SIZE (0)
@@ -106,8 +106,8 @@
 #define AUX1_RAM_START (0x20000400)
 #define AUX1_RAM_SIZE (191 * 1024)
 
-#define AUX2_RAM_START 0x10002000
-#define AUX2_RAM_SIZE (40 * 1024)
+#define AUX2_RAM_START 0x10002800
+#define AUX2_RAM_SIZE (38 * 1024)
 
 // misc
 #define CODE_ALIGNMENT 0x200
diff --git a/core/embed/models/T2T1/memory.ld b/core/embed/models/T2T1/memory.ld
index b449d078..661801d1 100644
--- a/core/embed/models/T2T1/memory.ld
+++ b/core/embed/models/T2T1/memory.ld
@@ -49,7 +49,7 @@ S_FB1_RAM_SIZE = 0x0;
 S_MAIN_RAM_START = 0x10004000;
 S_MAIN_RAM_SIZE = 0xbf00;
 K_MAIN_STACK_START = 0x10000000;
-K_MAIN_STACK_SIZE = 0x2000;
+K_MAIN_STACK_SIZE = 0x2800;
 K_FB1_RAM_START = 0x1000c000;
 K_FB1_RAM_SIZE = 0x0;
 K_MAIN_RAM_START = 0x1000c000;
@@ -60,7 +60,7 @@ DMABUF_RAM_START = 0x20000000;
 DMABUF_RAM_SIZE = 0x400;
 AUX1_RAM_START = 0x20000400;
 AUX1_RAM_SIZE = 0x2fc00;
-AUX2_RAM_START = 0x10002000;
-AUX2_RAM_SIZE = 0xa000;
+AUX2_RAM_START = 0x10002800;
+AUX2_RAM_SIZE = 0x9800;
 CODE_ALIGNMENT = 0x200;
 COREAPP_ALIGNMENT = 0x200;
diff --git a/core/embed/sys/linker/stm32f4/kernel.ld b/core/embed/sys/linker/stm32f4/kernel.ld
index 993a8bf3..f1b0b1a1 100644
--- a/core/embed/sys/linker/stm32f4/kernel.ld
+++ b/core/embed/sys/linker/stm32f4/kernel.ld
@@ -44,7 +44,7 @@ SECTIONS {
   } >FLASH AT>FLASH
 
   .stack : ALIGN(8) {
-    . += 8K; /* Exactly 8k allocated for stack. Overflow causes MemManage fault (when using MPU). */
+    . += 10K; /* Exactly 10k allocated for stack. Overflow causes MemManage fault (when using MPU). */
   } >MAIN_STACK
 
   .data : ALIGN(4) {

Risk score

Why this scored 32/100

Our methodology →

Potential impact 8/30

Exploitability 4/25

Stealth signal 5/15

Affected reach 7/15

Confidence 5/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 32/100

Community notes

Related watches

chore(core): remove sha1 from regular FW

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

refactor(crypto): change order of parameters