What the developer wrote
Authored by tychovrahe
fix(core): fix NFC IRQ - mpu reconfig
[no changelog]
What changed, and why it matters
This commit adds memory-protection reconfiguration around the NFC interrupt handler in Trezor hardware wallets. The change ensures the interrupt handler runs with default memory permissions, then restores the previous protection state afterward. It is a hardening fix rather than a clear-cut patch for an actively exploitable vulnerability, but missing MPU setup in an interrupt handler could theoretically allow memory-access bugs or privilege issues during NFC operations.
Treat as a hardening/defensive fix. Review whether the NFC interrupt handler previously executed with incorrect MPU permissions and confirm the restore path cannot fail or leave the MPU in a weaker state. Consider whether the callback invoked inside the handler needs the same protection. No immediate user action is indicated.
Security signals we found
MPU reconfiguration added inside an interrupt handler
MPU state saved and restored around callback invocation
IRQ logging markers added for tracing
No changelog entry provided
Change is small and localized to NFC driver
Evidence from the diff
The patch modifies NFC_EXTI_INTERRUPT_HANDLER() in core/embed/io/nfc/st25/nfc.c. It now calls mpu_reconfig(MPU_MODE_DEFAULT) on entry and mpu_restore(mode) on exit, plus adds IRQ_LOG_ENTER()/IRQ_LOG_EXIT(). The MPU (Memory Protection Unit) reconfiguration suggests the handler may need broader memory access than the normal protected mode provides, or that running without explicit MPU setup was unsafe. The change is defensive: it scopes the relaxed permissions strictly to the interrupt handler and restores them before returning.
Changed components
core/embed/io/nfc/st25/nfc.cNFC EXTI interrupt handlerST25 NFC driverMemory Protection Unit (MPU) configurationInspect captured patch +6 / −0
diff --git a/core/embed/io/nfc/st25/nfc.c b/core/embed/io/nfc/st25/nfc.c
index a09d6ff9..480b21b0 100644
--- a/core/embed/io/nfc/st25/nfc.c
+++ b/core/embed/io/nfc/st25/nfc.c
@@ -37,6 +37,7 @@
#include "rfal_rf.h"
#include "rfal_t2t.h"
#include "rfal_utils.h"
+#include "sys/mpu.h"
// NFC-A SEL_RES configured for Type 4A Tag Platform
#define LM_SEL_RES 0x20U
@@ -609,6 +610,8 @@ void nfc_ext_irq_set_callback(void (*cb)(void)) {
}
void NFC_EXTI_INTERRUPT_HANDLER(void) {
+ IRQ_LOG_ENTER();
+ mpu_mode_t mode = mpu_reconfig(MPU_MODE_DEFAULT);
st25_driver_t *drv = &g_st25_driver;
@@ -617,6 +620,9 @@ void NFC_EXTI_INTERRUPT_HANDLER(void) {
if (drv->nfc_irq_callback != NULL) {
drv->nfc_irq_callback();
}
+
+ mpu_restore(mode);
+ IRQ_LOG_EXIT();
}
static void nfc_card_emulator_loop(rfalNfcDevice *nfc_dev) {
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.