fix(core): improve reliability of nrf update
What the developer wrote
Authored by tychovrahe
fix(core): improve reliability of nrf update
[no changelog]
What changed, and why it matters
This commit makes a small change to the firmware update process for the nRF wireless chip inside some Trezor hardware wallets. It adds a one-second delay after writing the new firmware image, presumably to give the flash memory time to finish saving before rebooting the chip. The change is described as improving reliability, not fixing a security vulnerability. There is no direct evidence in the commit that this is exploitable or that it was caused by a security flaw.
Treat as a reliability fix unless additional evidence emerges linking the missing delay to a reproducible security failure. Users relying on nRF firmware updates should ensure they run firmware containing this patch. Security reviewers may want to confirm whether the one-second delay is sufficient for all supported flash configurations and whether the retry loop adequately handles partial/failed writes.
Security signals we found
Timing/race condition in firmware update path
Flash write completion not previously synchronized before reboot
Change described by vendor as reliability improvement, not security fix
Evidence from the diff
In core/embed/io/nrf/stm32u5/nrf_update.c, the patch reorders two header includes (moving sys/systick.h to the standard include block) and inserts a systick_delay_ms(1000) call immediately before nrf_reboot() in the nrf_update() function. The function writes a firmware image to the nRF chip, retries up to three times on failure, then reboots the chip. The added delay is intended to ensure flash write completion before reboot, addressing a potential race condition or incomplete write scenario during the update sequence.
Changed components
core/embed/io/nrf/stm32u5/nrf_update.cnRF wireless co-processor firmware update routineInspect captured patch +4 / −1
diff --git a/core/embed/io/nrf/stm32u5/nrf_update.c b/core/embed/io/nrf/stm32u5/nrf_update.c
index 9e6db1c6..1f7c1856 100644
--- a/core/embed/io/nrf/stm32u5/nrf_update.c
+++ b/core/embed/io/nrf/stm32u5/nrf_update.c
@@ -24,11 +24,11 @@
#include <trezor_rtl.h>
#include <io/nrf.h>
+#include <sys/systick.h>
#include "../nrf_internal.h"
#include "rust_smp.h"
#include "sha2.h"
-#include "sys/systick.h"
#define IMAGE_HASH_LEN 32
#define IMAGE_TLV_SHA256 0x10
@@ -148,6 +148,9 @@ bool nrf_update(const uint8_t *image_ptr, size_t image_len) {
try_cntr++;
} while (!result && try_cntr < 3);
+ // wait for flash to be written
+ systick_delay_ms(1000);
+
nrf_reboot();
nrf_set_dfu_mode(false);
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.