fix(core): Wait for Tropic to boot before trying to start session.
What the developer wrote
Authored by Andrew Kozlik
fix(core): Wait for Tropic to boot before trying to start session.
[no changelog]
(cherry picked from commit aa8fc7b31b5afbb5343814276cf09a29f779667d)
What changed, and why it matters
This change fixes how the Trezor hardware wallet waits for a small security chip called 'Tropic' to finish booting before starting a secure session. Previously, the code used a fixed 100-millisecond delay, which could be too short and cause the chip to respond with 'busy' errors. Now it actively polls the chip for up to one second until it reports it is ready. This is a reliability and robustness improvement rather than a fix for a clear-cut exploitable vulnerability.
Treat as a defensive hardening fix. Include in normal firmware release notes as a stability/reliability improvement for Tropic secure-element initialization. No urgent security advisory appears warranted based solely on this diff, but downstream consumers should ensure the fix is included in builds that use Tropic.
Security signals we found
Secure-element initialization timing hardening
Replacement of fixed delay with readiness polling
Prevention of LT_L1_CHIP_BUSY race during session establishment
Tropic privileged pairing key session startup depends on this path
Evidence from the diff
The patch replaces a fixed hal_delay(100) with a polling loop that repeatedly calls lt_get_info_riscv_fw_ver() until it stops returning LT_L1_CHIP_BUSY or a 1000 ms timeout elapses. The affected function is tropic_init() in core/embed/sec/tropic/tropic.c, which initializes the Tropic secure element before starting a privileged session. The old fixed delay was arbitrary and could be insufficient under some boot conditions, potentially leaving the secure element in a busy state when session_start() is invoked. The new approach waits for an explicit readiness signal.
Changed components
core/embed/sec/tropic/tropic.ctropic_init()Tropic secure element driverInspect captured patch +11 / −3
diff --git a/core/embed/sec/tropic/tropic.c b/core/embed/sec/tropic/tropic.c
index 903241343..36d162d0a 100644
--- a/core/embed/sec/tropic/tropic.c
+++ b/core/embed/sec/tropic/tropic.c
@@ -40,6 +40,9 @@
#ifdef SECURE_MODE
+// Maximum time to wait for Tropic to boot. Chosen arbitrarily.
+#define TROPIC_BOOT_TIMEOUT_MS 1000
+
typedef struct {
bool initialized;
pkey_index_t pairing_key_index;
@@ -123,9 +126,14 @@ bool tropic_init(void) {
goto cleanup;
}
- // Note: Without the delay below Tropic01 may return LT_L1_CHIP_BUSY. The
- // length was chosen arbitrarily. A shorter delay may be sufficient.
- hal_delay(100);
+ // Wait for Tropic to boot before issuing any session commands.
+ uint32_t boot_start_ms = hal_ticks_ms();
+ while (hal_ticks_ms() - boot_start_ms < TROPIC_BOOT_TIMEOUT_MS) {
+ uint8_t ver[LT_L2_GET_INFO_RISCV_FW_SIZE] = {0};
+ if (lt_get_info_riscv_fw_ver(&drv->handle, ver) != LT_L1_CHIP_BUSY) {
+ break;
+ }
+ }
#ifndef TREZOR_EMULATOR
if (session_start(drv, TROPIC_PRIVILEGED_PAIRING_KEY_SLOT)) {
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.