fix(core): add missing tz_init in kernel binary
What the developer wrote
Authored by cepetr
fix(core): add missing tz_init in kernel binary
[no changelog]
What changed, and why it matters
This commit adds a missing initialization call for the hardware security feature called TrustZone in the Trezor device's kernel. TrustZone helps separate sensitive code (like cryptographic secrets) from less trusted code. Without this initialization, the security boundary may not be set up correctly when the device boots in secure mode, potentially leaving the device in a less protected state. The fix is small but important: it ensures the security boundary is properly established before other system services start.
Treat this as a security fix and ensure it is included in the next firmware release. Review the boot sequence to confirm no other security-critical initialization calls are missing before system_init. Verify that tz_init() correctly configures all required TrustZone memory and peripheral protection settings. Consider adding a regression test or boot-time self-check that confirms TrustZone state is active before continuing boot.
Security signals we found
Missing security-critical initialization in boot path
TrustZone secure-world setup not invoked before system_init
Conditional on USE_TRUSTZONE and SECURE_MODE, indicating hardware-enforced isolation context
Kernel/main.c is the firmware's earliest trusted execution point
No changelog entry, reducing visibility of the security-relevant change
Evidence from the diff
The patch adds a call to tz_init() at the very beginning of main() in core/embed/projects/kernel/main.c, guarded by #if defined(USE_TRUSTZONE) && defined(SECURE_MODE). TrustZone (TZ) is the ARM security extension that partitions the system into Secure and Non-Secure worlds. tz_init() typically configures the TrustZone controller, memory protection, and peripheral access permissions so that the secure kernel owns sensitive resources. The absence of this call means the system could boot with default/reset TrustZone configuration rather than the intended secure policy, potentially leaving secure memory/regions accessible to non-secure code or failing to enforce isolation between the kernel and applications. The fix is partial evidence only: it shows the call was missing and is now added, but the diff does not reveal the actual behavior of tz_init() or any observed exploit.
Changed components
Trezor Core firmware kernelcore/embed/projects/kernel/main.cTrustZone secure-mode initialization pathInspect captured patch +4 / −0
diff --git a/core/embed/projects/kernel/main.c b/core/embed/projects/kernel/main.c
index a9c88ceb..b12b12ea 100644
--- a/core/embed/projects/kernel/main.c
+++ b/core/embed/projects/kernel/main.c
@@ -309,6 +309,10 @@ static void kernel_panic(const systask_postmortem_t *pminfo) {
}
int main(void) {
+#if defined(USE_TRUSTZONE) && defined(SECURE_MODE)
+ tz_init();
+#endif
+
// Initialize system's core services
system_init(&kernel_panic);
Why this scored 57/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.