nRF version readout for nRF App update using MCUboot SMP #6162

bleska · 2025-11-17T16:57:28Z

This PR resolves #6043 issue.

The nRF FW is divided into 2 parts: MCUboot and application. Both parts are flashed as a merged binary file at the production line where the MCUboot is immutable and application ca be updated throughout the time. The update in the field is performed by MCU FW which embeds the nRF application inside. The decision whether an update is needed is based on MCU to nRF application SPI communication and hash comparison. In case it fails, there is no information available for decision => it was assumed that nRF app image is corrupted and update is needed.

The PR leaves the MCU to nRF SPI communication and has comparison intact but offers another option of nRF app version readout via nRF MCUboot by using UART interface with MCUboot's SMP serial recovery feature see https://docs.nordicsemi.com/bundle/ncs-latest/page/zephyr/services/device_mgmt/smp_groups/smp_group_1.html . Specifically "Get state of images request/response".

github-actions · 2025-11-17T16:58:53Z

`en` main(all)

model	device_test	click_test	persistence_test
T2T1	test(all) main(all)	test(all) main(all)	test(all) main(all)
T3B1	test(all) main(all)	test(all) main(all)	test(all) main(all)
T3T1	test(all) main(all)	test(all) main(all)	test(all) main(all)
T3W1	test(all) main(all)	test(all) main(all)	test(all) main(all)

Latest CI run: 19671362919

github-actions · 2025-11-19T14:56:28Z

Looks like you changed Cargo.lock. Please make sure to review the dependencies and update internal version list.

… for realiability increase e.g. for cases when the nRF FW application is broken from whatever reason and can't reply to Trezor's FW version check for possible nRF FW update. [no changelog]

… SMP serial recovery. The RUST decoding has been added. The C-RUST API has been modified. Currently, the version is returned as a string (as received from nRF IC). [no changelog]

… SMP serial recovery. The RUST decoding has been added. The C-RUST API has been modified. Currently, the version is returned as a structure of 4 uint fields representing major, minor, revision and build_num respectively (string received from nRF IC is decoded). To be built with: "./scripts/build_sign_flash.sh -b t3w1_revA_nrf52832/nrf52832 -c -d -s -f" command. '-d' is essential, with '-p' the build script generates and signs the image in a way that MCUboot can't verify that (it uses debug keys see hash_signer.py but the MCUboot expects the production key which has embedded inside "image_validate.c" file). [no changelog]

Copilot

Pull Request Overview

This PR adds functionality to read the nRF app version via MCUboot SMP (Simple Management Protocol) serial recovery when normal SPI communication fails. This provides a fallback mechanism to determine whether an nRF firmware update is required.

Key changes:

Implements SMP Image State command support to query version information from nRF MCUboot
Adds version string parsing with overflow-safe integer conversion
Integrates the SMP version query as a fallback in the update detection logic when SPI communication fails

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
core/embed/rust/src/smp/mod.rs	Adds IMAGE_STATE command constant and ImageStateResponse message type handling
core/embed/rust/src/smp/image_info.rs	New module implementing SMP image state query, CBOR parsing, and version string parsing
core/embed/rust/src/smp/api.rs	Adds C FFI wrapper `smp_image_version_get()` with NrfAppVersion struct
core/embed/rust/rust_smp.h	Defines C-compatible `nrf_app_version_t` struct and function declaration
core/embed/io/nrf/stm32u5/nrf_update.c	Integrates SMP version fallback into update detection logic, adds version comparison and image header reading functions

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

core/embed/rust/rust_smp.h

core/embed/io/nrf/stm32u5/nrf_update.c

Copilot · 2025-11-20T10:09:00Z

core/embed/rust/rust_smp.h

 #include <trezor_types.h>

+/// Represents a parsed version string in the format:
+/// "major.minor.patch[.build_num]" where build_num is optional and defaults to


The comment refers to the third component as "patch" but the struct field is named revision. For consistency, either update the comment to say "major.minor.revision[.build_num]" or explain why the terminology differs from the struct field names.

Suggested change

/// "major.minor.patch[.build_num]" where build_num is optional and defaults to

/// "major.minor.revision[.build_num]" where build_num is optional and defaults to

Fixed here b12efb3 .

core/embed/rust/src/smp/api.rs

TychoVrahe · 2025-11-24T14:05:11Z

core/embed/io/nrf/stm32u5/nrf_update.c

    nrf_reboot();
    systick_delay_ms(500);
    try_cntr++;
    if (try_cntr > 3) {


lets try smp after the first SPI failure, the repeat both 3 times.

Fixed here 8319d25 .

It's subject to further changes because of #6188 issue.

TychoVrahe · 2025-11-24T14:06:29Z

core/embed/rust/rust_smp.h


 #include <trezor_types.h>

+/// Represents a parsed version string in the format:


thanks for adding comments here, please add it for the rest of functions here too, make it doxygen style and add license header while at it

Fixed here b12efb3 .

TychoVrahe · 2025-11-24T14:19:10Z

core/embed/io/nrf/stm32u5/nrf_update.c

+ * @return 0 on success, or a negative errno on failure
+ */
+static int nrf_smp_version_get(nrf_app_version_t *out_version) {
+  int rc = -1;


not much use for the errno here, maybe bool would be enough? applies to image_version_read too.

Fixed here 8319d25 . Also applied the same approach to "read_image_sha256()" which was the origin for the other 2 functions' refactored.

TychoVrahe · 2025-11-25T08:16:52Z

core/embed/rust/src/smp/image_info.rs

+    let revision = parse_u16(parts.next()?)?;
+
+    // Build number is optional (defaults to 0 if absent)
+    let build_num = match parts.next() {


somewhat more rustier version of writing this could be:

let build_num = parts .next() .filter(|b| !b.is_empty()) .map_or(Some(0), parse_u32)?;

but both versions should work

Fixed here 355574e .

TychoVrahe · 2025-11-25T08:37:43Z

core/embed/rust/src/smp/image_info.rs

+}
+
+/// Macro to generate overflow-safe decimal parsers for different integer types
+macro_rules! make_parser {


can we use let major = parts.next()?.parse::<u8>().ok()?; instead of these custom macro-generated functions?

Fixed here 355574e .

…MCUboot SMP serial recovery. The RUST decoding has been added. The C-RUST API has been modified. Currently, the version is returned as a structure of 4 uint fields representing major, minor, revision and build_num respectively (string received from nRF IC is decoded).

bleska · 2025-11-27T11:33:30Z

Can we perform another review round and then focus on what remains left, please?

bleska self-assigned this Nov 17, 2025

bleska added this to Firmware Nov 17, 2025

bleska added the T3W1 Trezor Safe 7 label Nov 17, 2025

github-project-automation bot moved this to 🔎 Needs review in Firmware Nov 17, 2025

bleska moved this from 🔎 Needs review to 🏃‍♀️ In progress in Firmware Nov 17, 2025

bleska force-pushed the bleska/nRF_FW_version_readout branch 2 times, most recently from bbe2996 to f11aa8b Compare November 19, 2025 16:11

bleska added 3 commits November 19, 2025 22:06

feat(core): implementation of nRF FW version readout via SMP commands…

4e71de0

… for realiability increase e.g. for cases when the nRF FW application is broken from whatever reason and can't reply to Trezor's FW version check for possible nRF FW update. [no changelog]

feat(core): demo version which reads out the version info via MCUboot…

5c5774a

… SMP serial recovery. The RUST decoding has been added. The C-RUST API has been modified. Currently, the version is returned as a string (as received from nRF IC). [no changelog]

bleska force-pushed the bleska/nRF_FW_version_readout branch from f11aa8b to 774e809 Compare November 19, 2025 23:49

bleska marked this pull request as ready for review November 20, 2025 10:02

bleska requested review from TychoVrahe, matejcik and obrusvit as code owners November 20, 2025 10:02

bleska requested review from Copilot and removed request for matejcik and obrusvit November 20, 2025 10:02

Copilot started reviewing on behalf of bleska November 20, 2025 10:02 View session

bleska moved this from 🏃‍♀️ In progress to 🔎 Needs review in Firmware Nov 20, 2025

Copilot finished reviewing on behalf of bleska November 20, 2025 10:07

Copilot AI reviewed Nov 20, 2025

View reviewed changes

TychoVrahe reviewed Nov 25, 2025

View reviewed changes

bleska added 4 commits November 25, 2025 11:39

bleska requested a review from TychoVrahe November 27, 2025 11:32

	/// "major.minor.patch[.build_num]" where build_num is optional and defaults to
	/// "major.minor.revision[.build_num]" where build_num is optional and defaults to


		#include <trezor_types.h>

		/// Represents a parsed version string in the format:

Uh oh!

nRF version readout for nRF App update using MCUboot SMP #6162

Are you sure you want to change the base?

nRF version readout for nRF App update using MCUboot SMP #6162

Uh oh!

Conversation

bleska commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

en main(all)

Uh oh!

github-actions bot commented Nov 19, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Nov 20, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bleska commented Nov 27, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bleska commented Nov 17, 2025 •

edited

Loading

github-actions bot commented Nov 17, 2025 •

edited

Loading

`en` main(all)