fix(core): remove irq locking from unpriv code
What the developer wrote
Authored by cepetr
fix(core): remove irq locking from unpriv code
[no changelog]
What changed, and why it matters
This commit changes how the Trezor firmware's embedded Python interpreter handles short 'atomic' critical sections. Previously, these sections disabled interrupts using a privileged system call. Now they are replaced with no-ops (do nothing). The stated reason is to remove interrupt locking from unprivileged code. The change could affect timing, race conditions, or security properties that relied on interrupt masking for atomicity, but the diff alone does not show an exploitable bug or a disclosed vulnerability.
Treat as a hardening/refactoring change requiring review, not as a confirmed vulnerability. Audit all call sites of MICROPY_BEGIN_ATOMIC_SECTION and MICROPY_END_ATOMIC_SECTION to ensure the removed interrupt masking is replaced by an appropriate synchronization primitive (e.g., MPU-aware lock, scheduler suspension, or privileged atomic helper) for each protected critical section. Verify that unprivileged code cannot trigger or exploit race conditions in GC, exception pending, or scheduler state. Request a security note or changelog entry from the vendor if none exists.
Security signals we found
Removal of interrupt-disable atomic sections in embedded firmware
Change from hardware atomicity (irq_lock) to no-op in MicroPython critical-section macros
Potential for race conditions or torn reads/writes in GC/runtime critical sections
No changelog entry and minimal commit detail
No explicit security framing in commit message or diff
Evidence from the diff
The patch modifies core/embed/projects/firmware/mpconfigport.h, redefining MicroPython’s MICROPY_BEGIN_ATOMIC_SECTION and MICROPY_END_ATOMIC_SECTION macros from irq_lock()/irq_unlock(state) to no-ops (0 and (void)(state)). It also removes the #include
Changed components
Trezor Core firmwareMicroPython port configuration (mpconfigport.h)Interrupt / atomic-section handlingGarbage collector and runtime critical sectionsInspect captured patch +2 / −4
diff --git a/core/embed/projects/firmware/mpconfigport.h b/core/embed/projects/firmware/mpconfigport.h
index 8af745ef..55463904 100644
--- a/core/embed/projects/firmware/mpconfigport.h
+++ b/core/embed/projects/firmware/mpconfigport.h
@@ -194,10 +194,8 @@ typedef int mp_int_t; // must be pointer size
typedef unsigned int mp_uint_t; // must be pointer size
typedef long mp_off_t;
-#include <sys/irq.h>
-
-#define MICROPY_BEGIN_ATOMIC_SECTION() irq_lock()
-#define MICROPY_END_ATOMIC_SECTION(state) irq_unlock(state)
+#define MICROPY_BEGIN_ATOMIC_SECTION() (0)
+#define MICROPY_END_ATOMIC_SECTION(state) (void)(state)
#define MICROPY_EVENT_POLL_HOOK \
do { \
extern void mp_handle_pending(bool); \
Why this scored 39/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.