chore(core): add syscall for reading telemetry data from app
What the developer wrote
Authored by tychovrahe
chore(core): add syscall for reading telemetry data from app
[no changelog]
What changed, and why it matters
This commit adds a new kernel syscall (a secure gateway) that lets applications read a telemetry data structure from the kernel. The syscall is guarded by a compile-time flag (USE_TELEMETRY) and uses the existing verifier pattern to check that the app has write access to the destination buffer before copying data. There is no direct evidence in the commit of a security vulnerability; it appears to be a routine addition of a read-only information channel.
Review the implementation of telemetry_get in sec/telemetry.h/c to confirm it only writes within sizeof(telemetry_data_t) and does not leak sensitive key material. Ensure USE_TELEMETRY is disabled in production firmware unless telemetry collection is explicitly intended. Treat this as a low-priority hygiene review rather than an active vulnerability.
Security signals we found
New syscall exposes kernel-side telemetry data to unprivileged applications
Verifier checks write access to the output buffer before kernel call
Guarded by USE_TELEMETRY compile-time flag, limiting exposure to telemetry-enabled builds
No changelog entry provided, consistent with 'chore' classification
No evidence of missing bounds checks, missing validation, or unsafe pointer handling in the diff
Evidence from the diff
The change introduces SYSCALL_TELEMETRY_GET and wires it through the Trezor Core syscall dispatch table, user-space stub, and verifier layer. The verifier calls probe_write_access(out, sizeof(*out)) before invoking telemetry_get(out), following the same pattern as other syscalls. The entire addition is wrapped in #ifdef USE_TELEMETRY, so it is only compiled in when telemetry support is enabled. No implementation of telemetry_get itself is shown, and no changelog entry is provided.
Changed components
core/embed/sys/syscall/inc/sys/syscall_numbers.hcore/embed/sys/syscall/stm32/syscall_dispatch.ccore/embed/sys/syscall/stm32/syscall_stubs.ccore/embed/sys/syscall/stm32/syscall_verifiers.ccore/embed/sys/syscall/stm32/syscall_verifiers.hInspect captured patch +48 / −0
diff --git a/core/embed/sys/syscall/inc/sys/syscall_numbers.h b/core/embed/sys/syscall/inc/sys/syscall_numbers.h
index e067c57e0..a16553c73 100644
--- a/core/embed/sys/syscall/inc/sys/syscall_numbers.h
+++ b/core/embed/sys/syscall/inc/sys/syscall_numbers.h
@@ -200,6 +200,7 @@ typedef enum {
SYSCALL_SECRET_KEYS_GET_DELEGATED_IDENTITY_KEY,
+ SYSCALL_TELEMETRY_GET,
// ------------------------------------------------------
// Following syscalls are executed in kernel thread mode
diff --git a/core/embed/sys/syscall/stm32/syscall_dispatch.c b/core/embed/sys/syscall/stm32/syscall_dispatch.c
index 1175f31b2..84ccefac1 100644
--- a/core/embed/sys/syscall/stm32/syscall_dispatch.c
+++ b/core/embed/sys/syscall/stm32/syscall_dispatch.c
@@ -80,6 +80,10 @@
#include <io/touch.h>
#endif
+#ifdef USE_TELEMETRY
+#include <sec/telemetry.h>
+#endif
+
#if PRODUCTION || BOOTLOADER_QA
#include <sec/boot_image.h>
#endif
@@ -497,6 +501,13 @@ __attribute((no_stack_protector)) void syscall_handler(uint32_t *args,
args[0] = secret_key_delegated_identity__verified(dest);
} break;
+#ifdef USE_TELEMETRY
+ case SYSCALL_TELEMETRY_GET: {
+ telemetry_data_t *out = (telemetry_data_t *)args[0];
+ args[0] = telemetry_get__verified(out);
+ } break;
+#endif
+
case SYSCALL_STORAGE_SETUP: {
PIN_UI_WAIT_CALLBACK callback = (PIN_UI_WAIT_CALLBACK)args[0];
storage_setup__verified(callback);
diff --git a/core/embed/sys/syscall/stm32/syscall_stubs.c b/core/embed/sys/syscall/stm32/syscall_stubs.c
index 61c0959e6..93273d8a4 100644
--- a/core/embed/sys/syscall/stm32/syscall_stubs.c
+++ b/core/embed/sys/syscall/stm32/syscall_stubs.c
@@ -497,6 +497,18 @@ secbool secret_key_delegated_identity(uint8_t dest[ECDSA_PRIVATE_KEY_SIZE]) {
(uint32_t)dest, SYSCALL_SECRET_KEYS_GET_DELEGATED_IDENTITY_KEY);
}
+// =============================================================================
+// telemetry.h
+// =============================================================================
+
+#ifdef USE_TELEMETRY
+#include <sec/telemetry.h>
+
+bool telemetry_get(telemetry_data_t *out) {
+ return (bool)syscall_invoke1((uint32_t)out, SYSCALL_TELEMETRY_GET);
+}
+#endif
+
// =============================================================================
// storage.h
// =============================================================================
diff --git a/core/embed/sys/syscall/stm32/syscall_verifiers.c b/core/embed/sys/syscall/stm32/syscall_verifiers.c
index 6d16ed65a..d82974c3b 100644
--- a/core/embed/sys/syscall/stm32/syscall_verifiers.c
+++ b/core/embed/sys/syscall/stm32/syscall_verifiers.c
@@ -598,6 +598,22 @@ access_violation:
// ---------------------------------------------------------------------
+#ifdef USE_TELEMETRY
+bool telemetry_get__verified(telemetry_data_t *out) {
+ if (!probe_write_access(out, sizeof(*out))) {
+ goto access_violation;
+ }
+
+ return telemetry_get(out);
+
+access_violation:
+ apptask_access_violation();
+ return false;
+}
+#endif
+
+// ---------------------------------------------------------------------
+
static PIN_UI_WAIT_CALLBACK storage_callback = NULL;
static secbool storage_callback_wrapper(uint32_t wait, uint32_t progress,
diff --git a/core/embed/sys/syscall/stm32/syscall_verifiers.h b/core/embed/sys/syscall/stm32/syscall_verifiers.h
index c78dce507..f8b98a1dc 100644
--- a/core/embed/sys/syscall/stm32/syscall_verifiers.h
+++ b/core/embed/sys/syscall/stm32/syscall_verifiers.h
@@ -167,6 +167,14 @@ bool __wur optiga_read_sec__verified(uint8_t *sec);
secbool secret_key_delegated_identity__verified(
uint8_t dest[ECDSA_PRIVATE_KEY_SIZE]);
+// ---------------------------------------------------------------------
+#ifdef USE_TELEMETRY
+
+#include <sec/telemetry.h>
+bool telemetry_get__verified(telemetry_data_t *out);
+
+#endif
+
// ---------------------------------------------------------------------
#include <sec/storage.h>
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.