chore(prodtest): Disable maintenance mode in Tropic R-config
What the developer wrote
Authored by Andrew Kozlik
chore(prodtest): Disable maintenance mode in Tropic R-config
(cherry picked from commit bbac55da0a74361c373b8aedc058f715d2cbee13)
What changed, and why it matters
This commit changes a production-test configuration for the Tropic secure chip so that 'maintenance mode' is disabled before the chip leaves the factory. Maintenance mode is typically a special low-level access mode used during manufacturing and testing; leaving it enabled in shipped devices could let someone with physical access or specialized tools perform operations that should not be allowed in the field. The change is a hardening step, not a fix for an actively exploited bug.
Verify that this prodtest binary is actually used in manufacturing and that devices already shipped were not left with MAINTENANCE_ENA set. If any field devices were provisioned under the old configuration, assess whether maintenance mode exposure requires a recall, firmware mitigation, or manufacturing-line-only remediation. No end-user action is needed.
Security signals we found
Disabling a manufacturing/debug access mode in final device configuration
Change is in production-test (prodtest) code, not end-user firmware runtime
Comment-only metadata update accompanies the bit change
Cherry-pick from another commit suggests backport/hardening
Evidence from the diff
In core/embed/projects/prodtest/cmd/prodtest_tropic.c, the reversible startup configuration (g_reversible_configuration) for the Tropic chip’s CFG_START_UP register is updated. Bit 3 (MAINTENANCE_ENA) is cleared from 1 (MAINTENANCE_ALLOWED) to 0 (MAINTENANCE_FORBIDDEN). The comment table is updated accordingly. This is a factory provisioning script change; it prevents the Tropic chip from being left in maintenance mode after production testing.
Changed components
core/embed/projects/prodtest/cmd/prodtest_tropic.cTropic secure chip CFG_START_UP register configurationTrezor device factory provisioning / production test flowInspect captured patch +7 / −7
diff --git a/core/embed/projects/prodtest/cmd/prodtest_tropic.c b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
index 36570ad4..31a20f5e 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_tropic.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
@@ -273,13 +273,13 @@ static const struct lt_config_t g_irreversible_configuration = {
static const struct lt_config_t g_reversible_configuration = {
.obj = {
// # CFG_START_UP (0x00)
- // | Setting | Value |
- // |-------------------------|-------------------------|
- // | RFU_1 (bit 0) | 1 |
- // | MBIST_DIS (bit 1) | 0 (TEST_ON) |
- // | RNGTEST_DIS (bit 2) | 0 (TEST_ON) |
- // | MAINTENANCE_ENA (bit 3) | 1 (MAINTENANCE_ALLOWED) |
- BIT(0) | BIT(3),
+ // | Setting | Value |
+ // |-------------------------|---------------------------|
+ // | RFU_1 (bit 0) | 1 |
+ // | MBIST_DIS (bit 1) | 0 (TEST_ON) |
+ // | RNGTEST_DIS (bit 2) | 0 (TEST_ON) |
+ // | MAINTENANCE_ENA (bit 3) | 0 (MAINTENANCE_FORBIDDEN) |
+ BIT(0),
// # CFG_SENSORS (0x08)
// | Setting | Value |
// |---------------------------------|----------------------|
Why this scored 57/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.