fix(core/xtask): pass block_on_vcp and app_loading features to the kernel
What the developer wrote
Authored by cepetr
fix(core/xtask): pass block_on_vcp and app_loading features to the kernel
[no changelog]
What changed, and why it matters
This commit fixes a build-system bug in Trezor's embedded firmware build tool. Two command-line options, `block_on_vcp` and `app_loading`, were previously only being forwarded to the firmware build, but not to the kernel build. The change moves them so they are passed to both the firmware and the kernel. This is a build-configuration fix; it does not directly change runtime code, but if the kernel was compiled without the intended flags, some expected security or behavior properties might not have been active.
Review the security implications of building the kernel without `block_on_vcp` and `app_loading` in prior builds. If those features gate security-relevant behavior, consider whether any released firmware was affected and whether a security advisory or changelog entry is warranted. Otherwise, treat as a normal build-system fix.
Security signals we found
Feature flag propagation bug in build tooling
Kernel may have been built without intended `block_on_vcp` or `app_loading` configuration
No direct runtime code change; risk depends on semantics of the omitted features
Evidence from the diff
In core/embed/xtask/src/feature_resolver.rs, the block_on_vcp and app_loading feature flags were previously added to the features vector only inside a branch that handled the firmware project. The patch moves them into a new branch that matches both Project::Firmware and Project::Kernel. This ensures that when building the kernel, these features are propagated correctly. The change is purely in the feature-resolution logic and affects how Cargo features are passed during the build.
Changed components
core/embed/xtask/src/feature_resolver.rsTrezor firmware build systemKernel build feature resolutionInspect captured patch +10 / −8
diff --git a/core/embed/xtask/src/feature_resolver.rs b/core/embed/xtask/src/feature_resolver.rs
index caadfe51..67ae0a89 100644
--- a/core/embed/xtask/src/feature_resolver.rs
+++ b/core/embed/xtask/src/feature_resolver.rs
@@ -66,14 +66,6 @@ pub fn resolve_features(args: &BuildArgs) -> Result<ResolvedBuild> {
features.push("log_stack_usage".into());
}
- if args.block_on_vcp {
- features.push("block_on_vcp".into());
- }
-
- if args.apps {
- features.push("app_loading".into());
- }
-
if args.mem_perf {
features.push("memperf".into());
}
@@ -87,6 +79,16 @@ pub fn resolve_features(args: &BuildArgs) -> Result<ResolvedBuild> {
}
}
+ if matches!(args.project, Project::Firmware | Project::Kernel) {
+ if args.block_on_vcp {
+ features.push("block_on_vcp".into());
+ }
+
+ if args.apps {
+ features.push("app_loading".into());
+ }
+ }
+
if matches!(
args.project,
Project::Secmon | Project::Kernel | Project::Firmware
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.