feat(core): increase secmon stack to 80KB

Trezor/Trezor firmware

461b324c View source ↗

Public commit record

What the developer wrote

Authored by cepetr

57/100 · Thin

feat(core): increase secmon stack to 80KB

[no changelog]

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit increases the secure monitor (secmont) stack size from 12 KB to 80 KB on Trezor hardware wallets and shifts memory layout to make room for it. A larger stack reduces the chance that a security-critical component runs out of memory and misbehaves, but the change itself is a routine resource adjustment, not a proven fix for an active attack. The commit does not describe any security bug or credit a researcher.

Recommended action

Treat as a hardening/resource-tuning change. Monitor for follow-up commits or advisories that explain whether the stack increase responds to a reproducible fault, overflow, or security finding. No immediate user action is indicated by this commit alone.

Security signals we found

Secure-monitor stack size increased substantially (12K -> 80K)

Data/bss sections relocated before stack to ensure placement in SRAM2 cleared on security events

Memory layout changes in secure-monitor region for D002 and T3W1 models

No changelog entry and no explicit security claim in commit message

Technical analysis

Evidence from the diff

The patch bumps the secmont stack reservation in core/embed/sys/linker/stm32u5g/secmon.ld from 12K to 80K and moves .data/.bss before .stack so they live in SRAM2 (cleared on security events). To accommodate the larger secure-monitor RAM, SECMON_RAM_SIZE grows from 64 KB to 96 KB in D002/T3W1 memory maps, while AUX1_RAM shrinks from 832 KB to 800 KB and its start address shifts by 0x8000. NONSECURE_RAM2 also shrinks and shifts. These are linker/memory-map changes for the secure monitor on STM32U5G-based Trezor models.

Changed components

Trezor Core firmware secure monitor (secmont) linker scriptD002 model memory mapT3W1 model memory mapSTM32U5G secure monitor RAM layout

Inspect captured patch +31 / −28

diff --git a/core/embed/models/D002/memory_secmon.h b/core/embed/models/D002/memory_secmon.h
index 455ddb53..e2894cd2 100644
--- a/core/embed/models/D002/memory_secmon.h
+++ b/core/embed/models/D002/memory_secmon.h
@@ -94,20 +94,20 @@
 #define NONSECURE_RAM1_START (0x20000200)
 #define NONSECURE_RAM1_SIZE (768 * 1024 - 512)
 
-#define NONSECURE_RAM2_START (0x200D0000)
-#define NONSECURE_RAM2_SIZE ((768 + 832 + 64) * 1024)
+#define NONSECURE_RAM2_START (0x200D8000)
+#define NONSECURE_RAM2_SIZE ((768 + 800 + 64) * 1024)
 
 #define FB1_RAM_START (0x20000200)
 #define FB1_RAM_SIZE (768 * 1024 - 512)
 
 #define SECMON_RAM_START (0x300C0000)
-#define SECMON_RAM_SIZE (64 * 1024)
+#define SECMON_RAM_SIZE (96 * 1024)
 
-#define FB2_RAM_START (0x200D0000)
+#define FB2_RAM_START (0x200D8000)
 #define FB2_RAM_SIZE (768 * 1024)
 
-#define AUX1_RAM_START (0x20190000)
-#define AUX1_RAM_SIZE (832 * 1024)
+#define AUX1_RAM_START (0x20198000)
+#define AUX1_RAM_SIZE (800 * 1024)
 
 #define MAIN_RAM_START (0x20260000)
 #define MAIN_RAM_SIZE (64 * 1024)
diff --git a/core/embed/models/D002/memory_secmon.ld b/core/embed/models/D002/memory_secmon.ld
index 37d043a7..b0619abd 100644
--- a/core/embed/models/D002/memory_secmon.ld
+++ b/core/embed/models/D002/memory_secmon.ld
@@ -52,16 +52,16 @@ BOOTARGS_START = 0x30000000;
 BOOTARGS_SIZE = 0x200;
 NONSECURE_RAM1_START = 0x20000200;
 NONSECURE_RAM1_SIZE = 0xbfe00;
-NONSECURE_RAM2_START = 0x200d0000;
-NONSECURE_RAM2_SIZE = 0x1a0000;
+NONSECURE_RAM2_START = 0x200d8000;
+NONSECURE_RAM2_SIZE = 0x198000;
 FB1_RAM_START = 0x20000200;
 FB1_RAM_SIZE = 0xbfe00;
 SECMON_RAM_START = 0x300c0000;
-SECMON_RAM_SIZE = 0x10000;
-FB2_RAM_START = 0x200d0000;
+SECMON_RAM_SIZE = 0x18000;
+FB2_RAM_START = 0x200d8000;
 FB2_RAM_SIZE = 0xc0000;
-AUX1_RAM_START = 0x20190000;
-AUX1_RAM_SIZE = 0xd0000;
+AUX1_RAM_START = 0x20198000;
+AUX1_RAM_SIZE = 0xc8000;
 MAIN_RAM_START = 0x20260000;
 MAIN_RAM_SIZE = 0x10000;
 CODE_ALIGNMENT = 0x400;
diff --git a/core/embed/models/T3W1/memory_secmon.h b/core/embed/models/T3W1/memory_secmon.h
index ce2c56de..d320c3f2 100644
--- a/core/embed/models/T3W1/memory_secmon.h
+++ b/core/embed/models/T3W1/memory_secmon.h
@@ -94,20 +94,20 @@
 #define NONSECURE_RAM1_START (0x20000200)
 #define NONSECURE_RAM1_SIZE (768 * 1024 - 512)
 
-#define NONSECURE_RAM2_START (0x200D0000)
-#define NONSECURE_RAM2_SIZE ((768 + 832 + 64) * 1024)
+#define NONSECURE_RAM2_START (0x200D8000)
+#define NONSECURE_RAM2_SIZE ((768 + 800 + 64) * 1024)
 
 #define FB1_RAM_START (0x20000200)
 #define FB1_RAM_SIZE (768 * 1024 - 512)
 
 #define SECMON_RAM_START (0x300C0000)
-#define SECMON_RAM_SIZE (64 * 1024)
+#define SECMON_RAM_SIZE (96 * 1024)
 
-#define FB2_RAM_START (0x200D0000)
+#define FB2_RAM_START (0x200D8000)
 #define FB2_RAM_SIZE (768 * 1024)
 
-#define AUX1_RAM_START (0x20190000)
-#define AUX1_RAM_SIZE (832 * 1024)
+#define AUX1_RAM_START (0x20198000)
+#define AUX1_RAM_SIZE (800 * 1024)
 
 #define MAIN_RAM_START (0x20260000)
 #define MAIN_RAM_SIZE (64 * 1024)
diff --git a/core/embed/models/T3W1/memory_secmon.ld b/core/embed/models/T3W1/memory_secmon.ld
index b8da5439..8ea5a32e 100644
--- a/core/embed/models/T3W1/memory_secmon.ld
+++ b/core/embed/models/T3W1/memory_secmon.ld
@@ -52,16 +52,16 @@ BOOTARGS_START = 0x30000000;
 BOOTARGS_SIZE = 0x200;
 NONSECURE_RAM1_START = 0x20000200;
 NONSECURE_RAM1_SIZE = 0xbfe00;
-NONSECURE_RAM2_START = 0x200d0000;
-NONSECURE_RAM2_SIZE = 0x1a0000;
+NONSECURE_RAM2_START = 0x200d8000;
+NONSECURE_RAM2_SIZE = 0x198000;
 FB1_RAM_START = 0x20000200;
 FB1_RAM_SIZE = 0xbfe00;
 SECMON_RAM_START = 0x300c0000;
-SECMON_RAM_SIZE = 0x10000;
-FB2_RAM_START = 0x200d0000;
+SECMON_RAM_SIZE = 0x18000;
+FB2_RAM_START = 0x200d8000;
 FB2_RAM_SIZE = 0xc0000;
-AUX1_RAM_START = 0x20190000;
-AUX1_RAM_SIZE = 0xd0000;
+AUX1_RAM_START = 0x20198000;
+AUX1_RAM_SIZE = 0xc8000;
 MAIN_RAM_START = 0x20260000;
 MAIN_RAM_SIZE = 0x10000;
 CODE_ALIGNMENT = 0x400;
diff --git a/core/embed/sys/linker/stm32u5g/secmon.ld b/core/embed/sys/linker/stm32u5g/secmon.ld
index 6d1927bc..c5e71ffb 100644
--- a/core/embed/sys/linker/stm32u5g/secmon.ld
+++ b/core/embed/sys/linker/stm32u5g/secmon.ld
@@ -64,10 +64,9 @@ SECTIONS {
     . = ALIGN(4);
   } >FLASH
 
-  .stack : ALIGN(8) {
-    . = 12K; /* Overflow causes UsageFault */
-  } >RAM
-
+  /* .data and .bss are intentionally placed before the .stack
+     section to ensure they are located in SRAM2, which is
+     cleared on security events */
   .data : ALIGN(4) {
     *(.data*);
     . = ALIGN(4);
@@ -78,6 +77,10 @@ SECTIONS {
     . = ALIGN(4);
   } >RAM
 
+  .stack : ALIGN(8) {
+    . = 80K; /* Overflow causes UsageFault */
+  } >RAM
+
   .fb1 : ALIGN(4) {
     *(.fb1*);
     . = ALIGN(4);

Risk score

Why this scored 24/100

Our methodology →

Potential impact 5/30

Exploitability 3/25

Stealth signal 4/15

Affected reach 5/15

Confidence 4/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 24/100

Community notes

Related watches

chore(core): remove sha1 from regular FW

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

refactor(crypto): change order of parameters