feat(core): Update suspend routine to keep optiga powered up until SEC counter clears.
What the developer wrote
Authored by kopecdav
feat(core): Update suspend routine to keep optiga powered up until SEC counter clears.
[no changelog]
What changed, and why it matters
This commit changes how the Trezor hardware wallet's low-power suspend/resume routine handles the Optiga security chip. Previously, the device fully shut down and later re-initialized Optiga during suspend and resume. Now it keeps Optiga powered and uses new suspend/resume helpers, with the suspend step moved out of secure mode so it can access the real-time-clock scheduler while waiting for an internal security counter to clear. The change is framed as a feature/refactor, but it touches security-critical hardware state and could affect secure-key availability or side-channel behavior if the new helpers are not equivalent to the old init/deinit cycle.
Review the paired implementation of optiga_suspend() and optiga_resume() and the SEC counter clearing logic. Verify that keeping Optiga powered does not weaken power-analysis resistance, that the non-secure suspend path cannot be abused to leave Optiga in an unintended state, and that resume fully restores the same security configuration as the previous optiga_init_and_configure() path. Consider whether this change warrants a changelog or security note.
Security signals we found
Security hardware (Optiga) power-state and lifecycle management changed
Secure-driver suspend/resume boundary moved between secure and non-secure contexts
Reference to an internal 'SEC counter' that must clear before power state changes
Removal of explicit deinit/re-init in favor of suspend/resume helpers whose implementation is not shown
No changelog entry despite touching security-critical code
Evidence from the diff
In core/embed/sys/suspend/stm32u5/suspend_io.c, the patch removes optiga_deinit()/optiga_init_and_configure() from suspend_secure_drivers()/resume_secure_drivers() and replaces them with optiga_suspend()/optiga_resume() called from the non-secure kernel suspend/resume path. The commit message says the goal is to ‘keep optiga powered up until SEC counter clears.’ The implementation detail comment notes that Optiga must be suspended from kernel context because the routine needs the RTC scheduler, which is unavailable in secure mode. The diff is small and does not show the implementation of optiga_suspend/resume or the SEC counter logic, so the full security implications cannot be verified from this commit alone.
Changed components
Trezor Core firmwareSTM32U5 suspend/resume power managementOptiga secure element driverSecure/non-secure boundary (TrustZone) schedulingInspect captured patch +12 / −9
diff --git a/core/embed/sys/suspend/stm32u5/suspend_io.c b/core/embed/sys/suspend/stm32u5/suspend_io.c
index 103340a71..ff0f11445 100644
--- a/core/embed/sys/suspend/stm32u5/suspend_io.c
+++ b/core/embed/sys/suspend/stm32u5/suspend_io.c
@@ -38,9 +38,7 @@
#endif
#ifdef USE_OPTIGA
-#include <sec/optiga_config.h>
-#include <sec/optiga_hal.h>
-#include <sec/optiga_transport.h>
+#include <sec/optiga_init.h>
#endif
#ifdef USE_RGB_LED
@@ -96,18 +94,12 @@ void suspend_secure_drivers() {
#ifdef USE_TROPIC
tropic_deinit();
#endif
-#ifdef USE_OPTIGA
- optiga_deinit();
-#endif
}
void resume_secure_drivers() {
#ifdef USE_STORAGE_HWKEY
secure_aes_init();
#endif
-#ifdef USE_OPTIGA
- optiga_init_and_configure();
-#endif
#ifdef USE_TROPIC
tropic_init();
#endif
@@ -118,6 +110,12 @@ void resume_secure_drivers() {
void suspend_drivers_phase1(power_save_wakeup_params_t *wakeup_params) {
suspend_secure_drivers();
+#ifdef USE_OPTIGA
+ // Optiga has to be suspended from kernel, since the suspend routine needs
+ // to access RTC scheduler which is not available in secure mode.
+ optiga_suspend();
+#endif
+
#ifdef USE_HAPTIC
haptic_deinit();
#endif
@@ -169,6 +167,11 @@ void resume_drivers(const power_save_wakeup_params_t *wakeup_params) {
#ifdef USE_BLE
ble_resume(&wakeup_params->ble);
#endif
+#ifdef USE_OPTIGA
+ // Optiga kernel part of resume routine
+ optiga_resume();
+#endif
+
resume_secure_drivers();
}
Why this scored 44/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.