fix(core): Fix broken Tropic initialization in prodtest.
What the developer wrote
Authored by Andrew Kozlik
fix(core): Fix broken Tropic initialization in prodtest.
Partially reverts 6cc6a8779a9a7bb002a76f87dda4d1ed3ff58c8b.
[no changelog]
What changed, and why it matters
This commit fixes a bug in the factory testing (prodtest) code for the Tropic secure chip on Trezor hardware wallets. A previous change accidentally made the Tropic chip appear uninitialized during secure session setup, which broke production tests. The fix restores correct tracking of whether the chip has been initialized, so the production line can reliably set up secure sessions.
Verify that the restored initialization sequence does not reintroduce any state-management issue the prior commit was trying to fix. Review the original commit 6cc6a8779a9a7bb002a76f87dda4d1ed3ff58c8b for context, run prodtest integration tests, and confirm drv->initialized is only set true after all security-critical setup steps complete.
Security signals we found
Regression in secure-element initialization state tracking
Production-test-only code path affected
Secure session establishment failure due to incorrect initialized flag handling
Possible denial-of-service to factory provisioning/validation workflow
Evidence from the diff
The patch partially reverts an earlier commit (6cc6a8779a9a7bb002a76f87dda4d1ed3ff58c8b) in core/embed/sec/tropic/tropic.c. In session_start(), the earlier commit set drv->initialized = false at the start and only set it to true on success. This caused a regression because tropic_init() checks drv->initialized after calling session_start(). The fix introduces a local ret variable for the return value and sets drv->initialized = true immediately after lt_init() succeeds in tropic_init(), before session_start() is called. It also removes the cleanup path that unconditionally called tropic_deinit() and returned false, which had the effect of always reporting initialization failure in prodtest.
Changed components
core/embed/sec/tropic/tropic.cTropic secure element driverprodtest (factory production test) flowInspect captured patch +5 / −6
diff --git a/core/embed/sec/tropic/tropic.c b/core/embed/sec/tropic/tropic.c
index 36d162d0a..b848e8bba 100644
--- a/core/embed/sec/tropic/tropic.c
+++ b/core/embed/sec/tropic/tropic.c
@@ -61,7 +61,7 @@ static bool tropic_get_tropic_pubkey(lt_handle_t *handle,
static bool session_start(tropic_driver_t *drv,
pkey_index_t pairing_key_index) {
- drv->initialized = false;
+ bool ret = false;
curve25519_key trezor_private = {0};
switch (pairing_key_index) {
@@ -101,12 +101,12 @@ static bool session_start(tropic_driver_t *drv,
}
drv->pairing_key_index = pairing_key_index;
- drv->initialized = true;
+ ret = true;
cleanup:
memzero(trezor_private, sizeof(trezor_private));
- return drv->initialized;
+ return ret;
}
bool tropic_init(void) {
@@ -123,8 +123,9 @@ bool tropic_init(void) {
#endif
if (lt_init(&drv->handle) != LT_OK) {
- goto cleanup;
+ return false;
}
+ drv->initialized = true;
// Wait for Tropic to boot before issuing any session commands.
uint32_t boot_start_ms = hal_ticks_ms();
@@ -149,8 +150,6 @@ bool tropic_init(void) {
}
#endif
-cleanup:
- tropic_deinit();
return false;
}
Why this scored 29/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.