What the developer wrote
Authored by Ondřej Vejpustek
fix(core): speed up tropic startup
[no changelog]
What changed, and why it matters
This commit adds a 135 millisecond delay during startup of the Tropic secure chip inside Trezor hardware wallets. The delay works around a bug where the chip briefly reports it is in 'maintenance mode' right after power-on, which causes an unnecessary reboot and slows down startup. It is a performance fix, not a security vulnerability fix, and it only affects non-production-test firmware builds.
No immediate security action required. Treat as a performance/compatibility workaround. Monitor upstream libtropic issue #550 and remove the delay after Tropic application firmware is upgraded past version 2.0.0. If the spurious maintenance-mode signal could be misused, verify with the vendor whether the chip's secure boot or access controls prevent any security-relevant state change during that window.
Security signals we found
Workaround for third-party component behavior (Tropic chip maintenance-mode flag)
Timing/startup race condition in secure-element initialization
Conditional compilation excludes production-test builds
Evidence from the diff
The change inserts systick_delay_ms(135) inside lt_port_init() in core/embed/sec/tropic/stm32/tropic01.c, guarded by #ifndef TREZOR_PRODTEST. The comment references upstream libtropic issue #550 and explains that Tropic’s application firmware (<= 2.0.0) incorrectly signals maintenance mode during startup. When LT_L1_READ_RETRY_DELAY_MS is too low, lt_init() sees the spurious status and reboots the chip, adding ~250 ms. The chosen 135 ms delay skips the maintenance-mode window on devices with MBIST and RNG self-tests enabled. The workaround is intended to be removed once Tropic firmware > 2.0.0 is deployed.
Changed components
core/embed/sec/tropic/stm32/tropic01.cTropic secure element initialization pathTrezor non-prodtest firmware startupInspect captured patch +17 / −0
diff --git a/core/embed/sec/tropic/stm32/tropic01.c b/core/embed/sec/tropic/stm32/tropic01.c
index 754de3ce..16db7f70 100644
--- a/core/embed/sec/tropic/stm32/tropic01.c
+++ b/core/embed/sec/tropic/stm32/tropic01.c
@@ -123,6 +123,23 @@ lt_ret_t lt_port_init(lt_l2_state_t *s2) {
HAL_SPI_Init(&drv->spi);
+// This is a fix for: https://github.com/tropicsquare/libtropic/issues/550
+// It can be removed once the Tropic application firmware is upgraded to
+// a version greater than 2.0.0.
+// The bug is that Tropic signals that it is in maintenance mode during
+// startup. This causes the chip to reboot in `lt_init()`, delaying the start
+// by 250 ms. It only manifests when `LT_L1_READ_RETRY_DELAY_MS` is too low.
+// A 124 ms delay was the shortest one found to skip the window in which
+// Tropic signals maintenance mode on a device with enabled memory
+// built-in self test (`MBIST_DIS = 0`) and RNG test (`RNGTEST_DIS = 0`).
+// 135 ms is used here in case it varies across devices.
+// We do not apply the fix in prodtest, because it would prolong the
+// duration of `prodtest_tropic_stress_init()`. The trade-off
+// is a slightly longer Tropic startup time in prodtest.
+#ifndef TREZOR_PRODTEST
+ systick_delay_ms(135);
+#endif
+
drv->initialized = true;
return LT_OK;
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.