What the developer wrote
Authored by cepetr
fix(core): fix mpu settings in secmon
[no changelog]
What changed, and why it matters
This commit fixes a memory-protection configuration bug in the Trezor hardware wallet's secure monitor (secmon) for STM32U5 devices. The code was using the wrong linker symbol (_codelen, which measures the entire firmware) to set the size of the protected secure-monitor memory region. It now uses the correct symbol (_secmon_size, which measures only the secure monitor). The effect is that the MPU (Memory Protection Unit) guard band around the secure monitor was likely oversized or misaligned, potentially weakening isolation between the secure monitor and the rest of the firmware.
Treat as a security-relevant hardening fix. Verify that the corrected _secmon_size linker symbol exists and yields a region aligned to MPU requirements. Review adjacent MPU region definitions for similar symbol mismatches, and consider whether the previous misconfiguration could have allowed access across the secure-monitor boundary. If a security advisory is warranted, disclose after confirming exploitability.
Security signals we found
Memory Protection Unit (MPU) misconfiguration in security-critical secure monitor (secmon)
Use of wrong linker symbol (_codelen vs _secmon_size) for protected region size
Potential weakening of isolation boundary between secure monitor and firmware/kernel
No changelog entry and minimal commit message, reducing transparency
Evidence from the diff
In core/embed/sys/mpu/stm32u5/mpu.c, the SECMON_SIZE macro under #ifdef SECMON was defined as the address of _codelen. _codelen is the firmware’s total code length, not the secure monitor’s size. The patch changes the extern declaration and macro to use _secmon_size, which is the dedicated linker symbol for the secure monitor’s size. This corrects the MPU region sizing for the secure monitor on STM32U5. The change is small and the commit message only says ‘fix mpu settings in secmon’ with no changelog or security framing.
Changed components
Trezor Core firmwareSTM32U5 MPU driver (core/embed/sys/mpu/stm32u5/mpu.c)Secure monitor (SECMON) memory regionInspect captured patch +2 / −2
diff --git a/core/embed/sys/mpu/stm32u5/mpu.c b/core/embed/sys/mpu/stm32u5/mpu.c
index 1dc4bceb1..d42ff6a42 100644
--- a/core/embed/sys/mpu/stm32u5/mpu.c
+++ b/core/embed/sys/mpu/stm32u5/mpu.c
@@ -163,9 +163,9 @@ _Static_assert(NORCOW_SECTOR_SIZE == STORAGE_2_MAXSIZE, "norcow misconfigured");
#define OTP_AND_ID_SIZE 0x800
#ifdef SECMON
-extern uint32_t _codelen;
+extern uint32_t _secmon_size;
#define SECMON_START FIRMWARE_START_S
-#define SECMON_SIZE (uint32_t) & _codelen
+#define SECMON_SIZE (uint32_t) & _secmon_size
#endif
#ifdef KERNEL
Why this scored 57/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.