diff --git a/SConscript.bootloader b/SConscript.bootloader
index 38d9612d7..07fe7ef7b 100644
--- a/SConscript.bootloader
+++ b/SConscript.bootloader
@@ -84,7 +84,6 @@ SOURCE_BOOTLOADER = [
     'embed/bootloader/bootui.c',
     'embed/bootloader/main.c',
     'embed/bootloader/messages.c',
-    'embed/bootloader/mpu.c',
     'embed/bootloader/nanopb/pb_common.c',
     'embed/bootloader/nanopb/pb_decode.c',
     'embed/bootloader/nanopb/pb_encode.c',
diff --git a/SConscript.firmware b/SConscript.firmware
index d9eb92140..579bfc162 100644
--- a/SConscript.firmware
+++ b/SConscript.firmware
@@ -264,6 +264,7 @@ SOURCE_TREZORHAL = [
     'embed/trezorhal/common.c',
     'embed/trezorhal/flash.c',
     'embed/trezorhal/mini_printf.c',
+    'embed/trezorhal/mpu.c',
     'embed/trezorhal/rng.c',
     'embed/trezorhal/sbu.c',
     'embed/trezorhal/sdcard.c',
diff --git a/embed/bootloader/main.c b/embed/bootloader/main.c
index a36251508..74422ee39 100644
--- a/embed/bootloader/main.c
+++ b/embed/bootloader/main.c
@@ -13,7 +13,7 @@
 
 #include "bootui.h"
 #include "messages.h"
-#include "mpu.h"
+// #include "mpu.h"
 
 const uint8_t BOOTLOADER_KEY_M = 2;
 const uint8_t BOOTLOADER_KEY_N = 3;
diff --git a/embed/extmod/modtrezorutils/modtrezorutils.c b/embed/extmod/modtrezorutils/modtrezorutils.c
index 51b187d38..61156a8a2 100644
--- a/embed/extmod/modtrezorutils/modtrezorutils.c
+++ b/embed/extmod/modtrezorutils/modtrezorutils.c
@@ -94,11 +94,25 @@ STATIC mp_obj_t mod_trezorutils_halt(size_t n_args, const mp_obj_t *args) {
 }
 STATIC MP_DEFINE_CONST_FUN_OBJ_VAR_BETWEEN(mod_trezorutils_halt_obj, 0, 1, mod_trezorutils_halt);
 
+/// def set_mode_unprivileged() -> None:
+///     '''
+///     Set unprivileged mode.
+///     '''
+STATIC mp_obj_t mod_trezorutils_set_mode_unprivileged(void) {
+#if defined TREZOR_STM32
+    __asm__ volatile("msr control, %0" :: "r" (0x1));
+    __asm__ volatile("isb");
+#endif
+    return mp_const_none;
+}
+STATIC MP_DEFINE_CONST_FUN_OBJ_0(mod_trezorutils_set_mode_unprivileged_obj, mod_trezorutils_set_mode_unprivileged);
+
 STATIC const mp_rom_map_elem_t mp_module_trezorutils_globals_table[] = {
     { MP_ROM_QSTR(MP_QSTR___name__), MP_ROM_QSTR(MP_QSTR_trezorutils) },
     { MP_ROM_QSTR(MP_QSTR_consteq), MP_ROM_PTR(&mod_trezorutils_consteq_obj) },
     { MP_ROM_QSTR(MP_QSTR_memcpy), MP_ROM_PTR(&mod_trezorutils_memcpy_obj) },
     { MP_ROM_QSTR(MP_QSTR_halt), MP_ROM_PTR(&mod_trezorutils_halt_obj) },
+    { MP_ROM_QSTR(MP_QSTR_set_mode_unprivileged), MP_ROM_PTR(&mod_trezorutils_set_mode_unprivileged_obj) },
 };
 
 STATIC MP_DEFINE_CONST_DICT(mp_module_trezorutils_globals, mp_module_trezorutils_globals_table);
diff --git a/embed/firmware/main.c b/embed/firmware/main.c
index adb36ca20..48634c6ee 100644
--- a/embed/firmware/main.c
+++ b/embed/firmware/main.c
@@ -17,12 +17,16 @@
 #include "common.h"
 #include "display.h"
 #include "flash.h"
+#include "mpu.h"
 #include "rng.h"
 #include "sdcard.h"
 #include "touch.h"
 
 int main(void)
 {
+    // Enable MPU
+    mpu_config();
+
     // Init peripherals
     pendsv_init();
     sdcard_init();
diff --git a/embed/bootloader/mpu.c b/embed/trezorhal/mpu.c
similarity index 93%
rename from embed/bootloader/mpu.c
rename to embed/trezorhal/mpu.c
index 3dd1a27d4..238ee27af 100644
--- a/embed/bootloader/mpu.c
+++ b/embed/trezorhal/mpu.c
@@ -1,3 +1,10 @@
+/*
+ * Copyright (c) Pavol Rusnak, SatoshiLabs
+ *
+ * Licensed under TREZOR License
+ * see LICENSE file for details
+ */
+
 #include STM32_HAL_H
 #include "stm32f4xx_ll_cortex.h"
 
@@ -42,7 +49,7 @@ void mpu_config(void)
     MPU->RBAR = CCMDATARAM_BASE | MPU_RBAR_VALID_Msk | MPU_REGION_NUMBER5;
     MPU->RASR = MPU_RASR_ENABLE_Msk | MPU_RASR_ATTR_SRAM | LL_MPU_REGION_SIZE_64KB | LL_MPU_REGION_FULL_ACCESS | MPU_RASR_XN_Msk;
 
-    // SRAM (0x20000000 - 0x2002FFFF, read-write, execute never)
+    // SRAM (0x20000000 - 0x2002FFFF, 192 KiB = 256 KiB except 2/8 at end, read-write, execute never)
     MPU->RBAR = SRAM_BASE | MPU_RBAR_VALID_Msk | MPU_REGION_NUMBER6;
     MPU->RASR = MPU_RASR_ENABLE_Msk | MPU_RASR_ATTR_SRAM | LL_MPU_REGION_SIZE_256KB | LL_MPU_REGION_FULL_ACCESS | MPU_RASR_XN_Msk | MPU_SUBREGION_DISABLE(0xC0);
 
diff --git a/embed/bootloader/mpu.h b/embed/trezorhal/mpu.h
similarity index 100%
rename from embed/bootloader/mpu.h
rename to embed/trezorhal/mpu.h
diff --git a/src/main.py b/src/main.py
index b83975e36..2e428a4f8 100644
--- a/src/main.py
+++ b/src/main.py
@@ -3,6 +3,7 @@ import boot
 from trezor import io
 from trezor import log
 from trezor import loop
+from trezor import utils
 from trezor import wire
 from trezor import workflow
 
@@ -99,6 +100,8 @@ if __debug__:
     wire.setup(usb_debug)
 usb.open()
 
+# utils.set_mode_unprivileged()
+
 # load default homescreen
 from apps.homescreen.homescreen import layout_homescreen
 
diff --git a/src/trezor/utils.py b/src/trezor/utils.py
index 208c614f4..bffccceaa 100644
--- a/src/trezor/utils.py
+++ b/src/trezor/utils.py
@@ -1,7 +1,7 @@
 import sys
 import gc
 
-from trezorutils import halt, memcpy
+from trezorutils import halt, memcpy, set_mode_unprivileged
 
 
 def unimport(genfunc):