fix(core): save some flash in board/bootloader
What the developer wrote
Authored by cepetr
fix(core): save some flash in board/bootloader
[no changelog]
What changed, and why it matters
This is a one-line build configuration change in low-level firmware code. It swaps the condition used to decide whether to compile a special secure-mode memory check. The change appears aimed at reducing flash memory usage in board/bootloader builds, not at fixing a security vulnerability. There is no direct evidence in the commit of a security issue.
Treat as a routine size-optimization/refactoring commit. If assessing security risk, verify that `SECMON` is defined exactly for the same build configurations where `__ARM_FEATURE_CMSE == 3U` was previously true, so the memory-access check is not unintentionally disabled in secure-monitor builds. No immediate security action is indicated by the commit itself.
Security signals we found
Change touches a fault/exception handler path that validates a return address before reading from it.
Change removes direct use of a compiler security-extension feature macro in favor of a project config symbol.
No changelog entry and commit framing is purely about flash savings, not security.
Evidence from the diff
The patch changes the preprocessor guard around a CMSE (ARMv8-M Security Extensions) memory-access verification path from defined(__ARM_FEATURE_CMSE) && (__ARM_FEATURE_CMSE == 3U) to #ifdef SECMON. This ties the secure-monitor-specific check to a project-defined symbol rather than the compiler’s ARM feature macro. The stated goal is flash-size savings in board/bootloader builds. The diff does not show any logic change, only a gating macro change.
Changed components
core/embed/sys/task/stm32/systask.cTrezor Core firmware exception/fault handling on STM32Secure-Monitor (SECMON) buildsInspect captured patch +1 / −1
diff --git a/core/embed/sys/task/stm32/systask.c b/core/embed/sys/task/stm32/systask.c
index de4d14e8..d57b3ddd 100644
--- a/core/embed/sys/task/stm32/systask.c
+++ b/core/embed/sys/task/stm32/systask.c
@@ -457,7 +457,7 @@ static uint32_t get_return_addr(bool secure, bool privileged, uint32_t sp) {
// Verify that ret_addr is in a readable region for
// the context that caused the exception.
-#if defined(__ARM_FEATURE_CMSE) && (__ARM_FEATURE_CMSE == 3U)
+#ifdef SECMON
// In Secure-Monitor mode, use CMSE intrinsics to check:
// - CMSE_MPU_READ indicates we only need read access
// - CMSE_MPU_UNPRIV if the fault originated from an unprivileged context
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.