fix(core): wait 500ms before rebooting to bootloader
What the developer wrote
Authored by Roman Zeyde
fix(core): wait 500ms before rebooting to bootloader
In general, Trezor should not wait for too long for a THP ACK after
sending the `Success` response (since the last ACK may be lost, similar
to [Two generals' agreement and TCP handshake](https://stackoverflow.com/q/36352236)).
[no changelog]
What changed, and why it matters
This change adjusts how a Trezor hardware wallet hands off from its main app to its bootloader during a firmware upgrade. Previously, the device would wait until the host computer acknowledged the 'I am rebooting' message before rebooting. Now it waits at most 500 milliseconds and reboots anyway if the acknowledgment doesn't arrive in time. The goal is to avoid getting stuck if that final acknowledgment packet is lost in transit, similar to how a phone call can hang waiting for a goodbye that never comes. The patch is a partial fix for a reliability issue in the device-host communication protocol.
Treat as a reliability/hardening fix rather than an urgent security patch. Review whether 500 ms is sufficient across all host transports and whether the THP layer itself needs a more robust lost-final-ACK handling strategy. If this fix was prompted by a user-reported hang or a security report, request the vendor to disclose any associated advisory or CVE.
Security signals we found
Change addresses a lost-final-ACK scenario in a device-host protocol (THP).
Introduces a bounded timeout where previously the code waited indefinitely for host acknowledgment before rebooting.
Commit message explicitly references a protocol reliability problem (Two Generals/TCP handshake analogy).
No changelog entry, suggesting the developer treated it as a minor fix rather than a security issue.
Patch is narrow: only one file, one function, and a single timeout constant.
Evidence from the diff
The commit modifies core/src/apps/management/reboot_to_bootloader.py. It replaces an unconditional await ctx.write(Success(…)) followed by a wait for the outgoing USB buffer to flush, with a 500 ms timeout race between sending the Success message and sleeping. If the Success message is not acknowledged within 500 ms, the device proceeds to flush the buffer and reboot. The commit message frames this as handling a lost final THP ACK, drawing an analogy to the two-generals/TCP handshake problem. The change is defensive and reduces the chance of an indefinite hang during the reboot-to-bootloader transition, but it does not add a full protocol-level fix for the lost-ACK scenario.
Changed components
core/src/apps/management/reboot_to_bootloader.pyTrezor firmware reboot-to-bootloader flowTHP (Trezor Host Protocol) Success message acknowledgment handlingInspect captured patch +12 / −3
diff --git a/core/src/apps/management/reboot_to_bootloader.py b/core/src/apps/management/reboot_to_bootloader.py
index 1b0523de..d7605173 100644
--- a/core/src/apps/management/reboot_to_bootloader.py
+++ b/core/src/apps/management/reboot_to_bootloader.py
@@ -1,4 +1,5 @@
import utime
+from micropython import const
from typing import TYPE_CHECKING
if TYPE_CHECKING:
@@ -8,6 +9,9 @@ if TYPE_CHECKING:
from trezor.messages import RebootToBootloader
+_REBOOT_SUCCESS_TIMEOUT_MS = const(500)
+
+
async def install_upgrade(
firmware_header: bytes, language_data_length: int
) -> tuple[BootCommand, bytes]:
@@ -94,9 +98,14 @@ async def reboot_to_bootloader(msg: RebootToBootloader) -> NoReturn:
boot_args = None
ctx = get_context()
- await ctx.write(Success(message="Rebooting"))
- # make sure the outgoing USB buffer is flushed
- await loop.wait(ctx.iface.iface_num() | io.POLL_WRITE)
+ # After ACK-ing the `Success` message (over THP), the host may already be waiting for the bootloader to start.
+ # In case this THP ACK packet is lost, the device should stop retransmissions, and reboot anyway.
+ res = await loop.race(
+ ctx.write(Success(message="Rebooting")), loop.sleep(_REBOOT_SUCCESS_TIMEOUT_MS)
+ )
+ if res is None:
+ # make sure the outgoing buffer is flushed
+ await loop.wait(ctx.iface.iface_num() | io.POLL_WRITE)
utime.sleep_ms(10)
# reboot to the bootloader, pass the firmware header hash if any
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.