fix(core/bootloader_ci): fix jumping to fw from CI bootloader
What the developer wrote
Authored by tychovrahe
fix(core/bootloader_ci): fix jumping to fw from CI bootloader
[no changelog]
What changed, and why it matters
This commit fixes the CI (continuous integration) bootloader so it correctly hands control over to the main firmware after running. It adds missing security-monitor verification, calls a secret-handoff routine before jumping, and passes startup arguments to the next stage. The change appears to be a bug fix for an internal test/CI bootloader rather than a fix for an exploitable security flaw in production devices.
Treat as a routine bootloader bug fix. Review whether the production bootloader already performs equivalent secret handoff and SECMON verification, and ensure the CI bootloader remains aligned with it. No urgent security response is indicated by the commit alone.
Security signals we found
Adds secret_reset() and secret_prepare_fw() calls in a bootloader handoff path
Adds security-monitor header signature, model, version, and integrity checks
Passes startup arguments to the next firmware stage instead of NULL
Changes vector table address calculation to account for security-monitor code offset
Evidence from the diff
The patch modifies core/embed/projects/bootloader_ci/main.c. It adds an include for sec/secret.h under USE_SECRET, calls secret_reset() early in main(), and later calls secret_prepare_fw(sectrue, sectrue) before deinitializing drivers and jumping to firmware. It also adds optional security-monitor (SECMON) header parsing and validation, computes a secmon_code_offset, and passes startup_args_export() to jump_to_next_stage() while adjusting the vector table address by the security-monitor code offset. The commit message frames this as fixing the jump from the CI bootloader to firmware.
Changed components
core/embed/projects/bootloader_ci/main.cTrezor Core CI bootloaderInspect captured patch +43 / −2
diff --git a/core/embed/projects/bootloader_ci/main.c b/core/embed/projects/bootloader_ci/main.c
index 5e39a9c5..6e4a5be9 100644
--- a/core/embed/projects/bootloader_ci/main.c
+++ b/core/embed/projects/bootloader_ci/main.c
@@ -53,6 +53,10 @@
#include <sec/tz_init.h>
#endif
+#ifdef USE_SECRET
+#include <sec/secret.h>
+#endif
+
#define USB_IFACE_NUM SYSHANDLE_USB_WIRE
static void drivers_init(void) {
@@ -176,6 +180,12 @@ int main(void) {
tz_init();
#endif
+#ifdef USE_SECRET
+ // because bootloader CI stops after each run, we must not reset in
+ // secret_prepare_fw in case the bhk is loaded, so reset rather here
+ secret_reset();
+#endif
+
system_init(&rsod_panic_handler);
drivers_init();
@@ -268,16 +278,47 @@ int main(void) {
&FIRMWARE_AREA),
"invalid firmware hash");
+ size_t secmon_code_offset = 0;
+
+#ifdef USE_SECMON_VERIFICATION
+ size_t secmon_start = (size_t)IMAGE_CODE_ALIGN(FIRMWARE_START + vhdr.hdrlen +
+ IMAGE_HEADER_SIZE);
+ const secmon_header_t *secmon_hdr =
+ read_secmon_header((const uint8_t *)secmon_start, FIRMWARE_MAXSIZE);
+
+ if (secmon_hdr != NULL) {
+ secmon_code_offset = IMAGE_CODE_ALIGN(SECMON_HEADER_SIZE);
+ }
+
+ ensure((secmon_hdr != NULL) * sectrue, "Secmon header not found");
+
+ ensure(check_secmon_model(secmon_hdr), "Wrong secmon model");
+
+ ensure(check_secmon_header_sig(secmon_hdr), "Invalid secmon signature");
+
+ ensure(check_secmon_min_version(secmon_hdr->monotonic),
+ "Secmon downgrade protection");
+
+ ensure(check_secmon_contents(secmon_hdr, secmon_start - FIRMWARE_START,
+ &FIRMWARE_AREA),
+ "Secmon is corrupted");
+
+#endif
+
// do not check any trust flags on header, proceed
+#ifdef USE_SECRET
+ secret_prepare_fw(sectrue, sectrue);
+#endif
drivers_deinit();
system_deinit();
uint32_t vectbl_addr =
- IMAGE_CODE_ALIGN(FIRMWARE_START + vhdr.hdrlen + IMAGE_HEADER_SIZE);
+ IMAGE_CODE_ALIGN(FIRMWARE_START + vhdr.hdrlen + IMAGE_HEADER_SIZE) +
+ secmon_code_offset;
- jump_to_next_stage(vectbl_addr, NULL);
+ jump_to_next_stage(vectbl_addr, startup_args_export());
return 0;
}
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.