fix(core): fix tropic retry-command reset sequence
What the developer wrote
Authored by tychovrahe
fix(core): fix tropic retry-command reset sequence
[no changelog]
What changed, and why it matters
This commit changes the order of two cleanup steps when a Tropic secure chip hits an alarm mode during a retry. Previously the code de-initialized the driver before resetting the chip; now it resets the chip first, then de-initializes, then re-initializes. The change is defensive and likely fixes a bug where the retry/reset sequence could leave the chip or driver in an inconsistent state. There is no claim in the commit that this is a security vulnerability, and no external references are provided.
Treat as a normal bug-fix commit. Review the Tropic01 datasheet and driver lifecycle to confirm the new reset/deinit/init ordering matches the required sequence. If this component protects cryptographic keys or signing operations, consider whether the old ordering could have produced transient failures or key-handling inconsistencies, but do not assume a security vulnerability without further evidence.
Security signals we found
Secure-element driver retry/reset path modified
Reset and de-initialization order swapped
No changelog entry provided
No CVE, advisory, or security description in commit
Evidence from the diff
In core/embed/sec/tropic/tropic.c, the TROPIC_RETRY_COMMAND macro swaps tropic_deinit() and tropic01_reset(). The new sequence is: reset the Tropic01 chip, de-initialize the driver, initialize the driver, wait for ready. The old sequence de-initialized before reset, which could mean the reset happened while the driver was already torn down or that resources needed for a clean reset were released too early. The patch is a one-line reorder in a retry path triggered by LT_L1_CHIP_ALARM_MODE.
Changed components
core/embed/sec/tropic/tropic.cTropic01 secure-element driver retry commandInspect captured patch +1 / −1
diff --git a/core/embed/sec/tropic/tropic.c b/core/embed/sec/tropic/tropic.c
index b281b73a4..a6b7b87b5 100644
--- a/core/embed/sec/tropic/tropic.c
+++ b/core/embed/sec/tropic/tropic.c
@@ -94,8 +94,8 @@ static bool is_retryable(lt_ret_t ret) {
break; \
} \
if (TROPIC_RETRY_COMMAND_res == LT_L1_CHIP_ALARM_MODE) { \
- tropic_deinit(); \
tropic01_reset(); \
+ tropic_deinit(); \
tropic_init(); \
tropic_wait_for_ready(); \
if (TROPIC_RETRY_COMMAND_session_started) { \
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.