fix(core/embed): fix tropic deinitialization
What the developer wrote
Authored by Ondřej Vejpustek
fix(core/embed): fix tropic deinitialization
[no changelog]
What changed, and why it matters
This commit fixes a small bug in how the Trezor hardware wallet shuts down communication with a Tropic secure chip. Previously, after deinitialization, the driver still thought it was initialized. This could allow later code to mistakenly try to use the chip after it was powered off, leading to failed operations or unexpected behavior. The fix simply marks the driver as not initialized during shutdown.
Review all callers of lt_port_deinit and any code that gates on drv->initialized to confirm no reachable path can attempt chip access after deinitialization. Consider adding defensive checks in init/reinit paths. No urgent action beyond applying the patch is indicated by the diff alone.
Security signals we found
Missing state reset on deinitialization
Potential use-after-deinit of secure-element driver
State flag inconsistency between hardware and software
Evidence from the diff
In core/embed/sec/tropic/stm32/tropic01.c, the lt_port_deinit() function tears down SPI and power GPIOs for the Tropic01 secure element but did not clear the drv->initialized flag. The patch adds drv->initialized = false; after GPIO deinitialization. Without this, state-dependent code paths that check initialized could proceed after the peripheral is disabled, potentially causing use-after-deinit conditions, failed transactions, or inconsistent driver state.
Changed components
core/embed/sec/tropic/stm32/tropic01.cTropic01 secure element driverTrezor Core firmwareInspect captured patch +2 / −0
diff --git a/core/embed/sec/tropic/stm32/tropic01.c b/core/embed/sec/tropic/stm32/tropic01.c
index b9d9e5178..1aef0e413 100644
--- a/core/embed/sec/tropic/stm32/tropic01.c
+++ b/core/embed/sec/tropic/stm32/tropic01.c
@@ -139,6 +139,8 @@ lt_ret_t lt_port_deinit(lt_l2_state_t *s2) {
HAL_GPIO_DeInit(TROPIC01_SPI_MOSI_PORT, TROPIC01_SPI_MOSI_PIN);
HAL_GPIO_DeInit(TROPIC01_PWR_PORT, TROPIC01_PWR_PIN);
+ drv->initialized = false;
+
return LT_OK;
}
Why this scored 28/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.