What the developer wrote
Authored by cepetr
fix(core): minor fixes
[no changelog]
What changed, and why it matters
This is a routine cleanup commit in Trezor's embedded firmware. It mostly adds or tightens conditional compilation guards (so certain security-related code only compiles in secure/kernel builds), removes unused header includes, fixes a minor function declaration, and replaces a traditional header include guard with a simpler pragma. There is no direct evidence of an exploitable vulnerability being patched, and the commit message explicitly calls these 'minor fixes' with no changelog entry.
No urgent action required. Treat as normal maintenance. If auditing, verify that the new SECURE_MODE/KERNEL_MODE guards correctly prevent security-only code from being compiled into non-secure builds (e.g., emulator, prodtest, boardloader) without breaking legitimate functionality.
Security signals we found
Tightening conditional compilation so security-sensitive modules (secure AES, Optiga, backup RAM, Tropic, hash processor, secret, monoctr) are only included in SECURE_MODE builds
Adding KERNEL_MODE guards around kernel-only display and flash utility code
Removing unused security-related header include (`sec/secure_aes.h`) from kernel main
Renaming feature guard `USE_NRF` to `USE_NRF_AUTH` to clarify authentication-specific code path
Evidence from the diff
The diff is a collection of small build-system and code hygiene changes across 13 files in the Trezor firmware core. Key changes: (1) Adds #ifdef KERNEL_MODE / #ifdef SECURE_MODE guards around code that should only compile in those modes (display_ltdc.c, flash_utils.c, monoctr.c, secret.c, mpu.c). (2) Tightens feature-gate conditions in kernel/main.c from #ifdef USE_* to #if SECURE_MODE && USE_* for hash_processor, secure_aes, optiga_init, backup_ram, and tropic. (3) Changes prodtest/emulator.c to only include sec/secret.h when LOCKABLE_BOOTLOADER is defined. (4) Fixes get_board_name() from const uint32_t to uint32_t return type. (5) Replaces manual include guards with #pragma once in one header. (6) Removes unused includes (sec/secure_aes.h, io/suspend.h, io/ble.h, trezor_bsp.h). (7) Renames a feature guard from USE_NRF to USE_NRF_AUTH in smcall_stubs.c. These are defensive build-hardening and cleanup changes rather than patches for a specific reported security bug.
Changed components
core/embed/projects/kernel/main.ccore/embed/sec/secret/stm32u5/secret.ccore/embed/sec/monoctr/unix/monoctr.ccore/embed/sys/flash/flash_utils.ccore/embed/sys/mpu/stm32f4/mpu.ccore/embed/sys/smcall/stm32/smcall_stubs.ccore/embed/projects/prodtest/emulator.ccore/embed/io/display/stm32f429i-disc1/display_ltdc.cInspect captured patch +31 / −19
diff --git a/core/embed/io/display/stm32f429i-disc1/display_internal.h b/core/embed/io/display/stm32f429i-disc1/display_internal.h
index fbb15a1b..62705a48 100644
--- a/core/embed/io/display/stm32f429i-disc1/display_internal.h
+++ b/core/embed/io/display/stm32f429i-disc1/display_internal.h
@@ -17,8 +17,7 @@
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
-#ifndef TREZORHAL_DISPLAY_INTERNAL_H
-#define TREZORHAL_DISPLAY_INTERNAL_H
+#pragma once
#include <trezor_bsp.h>
#include <trezor_types.h>
@@ -32,5 +31,3 @@
// Initializes LTDC controller and I/O pins
void BSP_LCD_Init(void);
-
-#endif // TREZORHAL_DISPLAY_INTERNAL_H
diff --git a/core/embed/io/display/stm32f429i-disc1/display_ltdc.c b/core/embed/io/display/stm32f429i-disc1/display_ltdc.c
index ed83a5e1..b42cbe2b 100644
--- a/core/embed/io/display/stm32f429i-disc1/display_ltdc.c
+++ b/core/embed/io/display/stm32f429i-disc1/display_ltdc.c
@@ -17,6 +17,8 @@
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
+#ifdef KERNEL_MODE
+
#include <trezor_bsp.h>
#include <trezor_model.h>
#include <trezor_rtl.h>
@@ -287,3 +289,5 @@ void BSP_LCD_Init(void) {
memset((void *)FRAME_BUFFER_ADDR, 0, FRAME_BUFFER_SIZE);
}
+
+#endif // KERNEL_MODE
diff --git a/core/embed/projects/kernel/main.c b/core/embed/projects/kernel/main.c
index d849a649..538b6133 100644
--- a/core/embed/projects/kernel/main.c
+++ b/core/embed/projects/kernel/main.c
@@ -27,7 +27,6 @@
#include <sec/boot_image.h>
#include <sec/option_bytes.h>
#include <sec/random_delays.h>
-#include <sec/secure_aes.h>
#include <sec/unit_properties.h>
#include <sys/bootutils.h>
#include <sys/coreapp.h>
@@ -58,23 +57,27 @@
#include <io/haptic.h>
#endif
-#ifdef USE_HASH_PROCESSOR
+#if SECURE_MODE && USE_HASH_PROCESSOR
#include <sec/hash_processor.h>
#endif
+#if SECURE_MODE && USE_STORAGE_HWKEY
+#include <sec/secure_aes.h>
+#endif
+
#ifdef USE_SECRET
#include <sec/secret.h>
#endif
-#ifdef USE_OPTIGA
+#if SECURE_MODE && USE_OPTIGA
#include <sec/optiga_init.h>
#endif
-#ifdef USE_BACKUP_RAM
+#if SECURE_MODE && USE_BACKUP_RAM
#include <sec/backup_ram.h>
#endif
-#ifdef USE_TROPIC
+#if SECURE_MODE && USE_TROPIC
#include <sec/tropic.h>
#endif
diff --git a/core/embed/projects/prodtest/emulator.c b/core/embed/projects/prodtest/emulator.c
index 261812c4..3db3e016 100644
--- a/core/embed/projects/prodtest/emulator.c
+++ b/core/embed/projects/prodtest/emulator.c
@@ -7,10 +7,13 @@
#include <SDL.h>
#include <io/display.h>
-#include <sec/secret.h>
#include <sys/flash.h>
#include <sys/flash_otp.h>
+#ifdef LOCKABLE_BOOTLOADER
+#include <sec/secret.h>
+#endif
+
int prodtest_main(void);
void usage(void) {
diff --git a/core/embed/sec/board_capabilities/stm32/board_capabilities.c b/core/embed/sec/board_capabilities/stm32/board_capabilities.c
index efe1f8fb..6891633c 100644
--- a/core/embed/sec/board_capabilities/stm32/board_capabilities.c
+++ b/core/embed/sec/board_capabilities/stm32/board_capabilities.c
@@ -29,7 +29,7 @@ static uint32_t board_name = 0;
static boardloader_version_t boardloader_version = {0};
-const uint32_t get_board_name() { return board_name; }
+uint32_t get_board_name() { return board_name; }
void get_boardloader_version(boardloader_version_t *version) {
*version = boardloader_version;
diff --git a/core/embed/sec/monoctr/unix/monoctr.c b/core/embed/sec/monoctr/unix/monoctr.c
index b874711e..d59ff42e 100644
--- a/core/embed/sec/monoctr/unix/monoctr.c
+++ b/core/embed/sec/monoctr/unix/monoctr.c
@@ -17,6 +17,8 @@
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
+#ifdef SECURE_MODE
+
#include <trezor_model.h>
#include <trezor_rtl.h>
@@ -122,3 +124,5 @@ secbool monoctr_read(monoctr_type_t type, uint8_t* value) {
return sectrue;
}
+
+#endif // SECURE_MODE
diff --git a/core/embed/sec/secret/stm32u5/secret.c b/core/embed/sec/secret/stm32u5/secret.c
index ebba4ff3..ac6b47a3 100644
--- a/core/embed/sec/secret/stm32u5/secret.c
+++ b/core/embed/sec/secret/stm32u5/secret.c
@@ -17,6 +17,8 @@
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
+#ifdef SECURE_MODE
+
#include <trezor_bsp.h>
#include <trezor_model.h>
#include <trezor_rtl.h>
@@ -31,8 +33,6 @@
#include <sys/rng.h>
#include "memzero.h"
-#ifdef SECURE_MODE
-
#define SECRET_HEADER_MAGIC "TRZS"
#define SECRET_HEADER_MAGIC_LEN (sizeof(SECRET_HEADER_MAGIC) - 1)
diff --git a/core/embed/sys/cpuid/unix/cpuid.c b/core/embed/sys/cpuid/unix/cpuid.c
index 4a452719..b1b3ec66 100644
--- a/core/embed/sys/cpuid/unix/cpuid.c
+++ b/core/embed/sys/cpuid/unix/cpuid.c
@@ -17,7 +17,6 @@
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
-#include <trezor_bsp.h>
#include <trezor_rtl.h>
#include <sys/cpuid.h>
diff --git a/core/embed/sys/flash/flash_utils.c b/core/embed/sys/flash/flash_utils.c
index 07d60586..87b91107 100644
--- a/core/embed/sys/flash/flash_utils.c
+++ b/core/embed/sys/flash/flash_utils.c
@@ -17,6 +17,8 @@
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
+#ifdef KERNEL_MODE
+
#include <trezor_model.h>
#include <trezor_rtl.h>
@@ -101,3 +103,5 @@ secbool erase_device(flash_progress_callback_t progress_cb) {
return erase_areas(areas, ARRAY_LENGTH(areas), progress_cb);
}
+
+#endif // KERNEL_MODE
diff --git a/core/embed/sys/mpu/stm32f4/mpu.c b/core/embed/sys/mpu/stm32f4/mpu.c
index ee2455b2..6fa7319d 100644
--- a/core/embed/sys/mpu/stm32f4/mpu.c
+++ b/core/embed/sys/mpu/stm32f4/mpu.c
@@ -17,6 +17,8 @@
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
+#ifdef KERNEL_MODE
+
// Turning off the stack protector for this file significantly improves
// the performance of the syscall dispatching and interrupt handling.
#pragma GCC optimize("no-stack-protector")
@@ -31,8 +33,6 @@
#include "stm32f4xx_ll_cortex.h"
-#ifdef KERNEL_MODE
-
// http://infocenter.arm.com/help/topic/com.arm.doc.dui0552a/BABDJJGF.html
#define MPU_RASR_ATTR_FLASH_CODE (MPU_RASR_C_Msk)
#define MPU_RASR_ATTR_FLASH_DATA (MPU_RASR_C_Msk | MPU_RASR_XN_Msk)
diff --git a/core/embed/sys/smcall/stm32/smcall_stubs.c b/core/embed/sys/smcall/stm32/smcall_stubs.c
index 47f50421..b2d777c5 100644
--- a/core/embed/sys/smcall/stm32/smcall_stubs.c
+++ b/core/embed/sys/smcall/stm32/smcall_stubs.c
@@ -395,7 +395,7 @@ bool backup_ram_write(uint16_t key, backup_ram_item_type_t type,
#endif // USE_BACKUP_RAM
-#ifdef USE_NRF
+#ifdef USE_NRF_AUTH
#include <sec/secret.h>
diff --git a/core/embed/sys/syscall/stm32/syscall_dispatch.c b/core/embed/sys/syscall/stm32/syscall_dispatch.c
index e7f97e49..ceede694 100644
--- a/core/embed/sys/syscall/stm32/syscall_dispatch.c
+++ b/core/embed/sys/syscall/stm32/syscall_dispatch.c
@@ -19,7 +19,6 @@
#ifdef KERNEL
#include <stdint.h>
-#include "embed/io/ble/inc/io/ble.h"
#include <trezor_rtl.h>
diff --git a/core/embed/sys/time/stm32u5/rtc.c b/core/embed/sys/time/stm32u5/rtc.c
index 420cfee5..10b087ca 100644
--- a/core/embed/sys/time/stm32u5/rtc.c
+++ b/core/embed/sys/time/stm32u5/rtc.c
@@ -22,7 +22,6 @@
#include <trezor_bsp.h>
#include <trezor_rtl.h>
-#include <io/suspend.h>
#include <sys/irq.h>
#include <sys/mpu.h>
#include <sys/rtc.h>
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.