Trezor firmware

This commit fixes a minor formatting bug in the Trezor production-test command-line tool. Previously, every response line in non-interactive mode had an extra blank line (CRLF) appended. The change moves that blank line so it only appears in interactive mode, where it serves as a prompt separator. There is no security relevance in the commit or diff.

This commit removes a single leftover debug logging line that printed the contents of a channel allocation packet. It is a cleanup change with no security relevance: the log line was informational, not an error, and removing it does not fix a vulnerability or change any behavior an attacker could exploit.

This is a small code cleanup in Trezor's Python library for a newer transport protocol (THP). It changes a helper function so it returns 'no sequence bit' for message types that don't carry one, and adds an assertion to catch any unexpected case. The change is labeled a refactor with no changelog and appears defensive rather than a fix for an active security bug.

This commit is a simple code cleanup: it removes a small helper method and places its contents directly into the function that called it. No behavior changes, no security fixes, and no new risks are visible.

This commit changes the Trezor Python library's handling of messages sent over the new THP (Trezor Host Protocol) transport. Previously, if a message had a bad checksum, the code would read a new message but did not track whether the newly received message was a fresh one or an old retransmission. The new code loops until it receives a message that passes the checksum and also has the expected sequence/sync bit, ignoring stale or out-of-order retransmissions. This is a hardening change: it makes the host-side protocol implementation more robust against duplicate or replayed packets, which could otherwise confuse state machines or cause commands to be processed twice.

This commit changes internal test-only debug code in the Trezor firmware so that the debug communication session can be cleanly shut down between test scenarios. It adds a flag, a mailbox signal, and a timeout-based join to prevent the debug task from getting stuck when the test framework restarts the device's event loop. The production security relevance appears low because the code is wrapped in `if __debug__` and only used during automated UI tests.

This is a one-line internal code cleanup in Trezor's task scheduler. It changes how a background racing task is advanced, switching from a public scheduling function to a direct internal stepping call. There is no visible security problem in the diff itself, and no security context is provided by the vendor.

This is a small cleanup change in the Trezor firmware's internal message-handling loop. It makes sure a special developer/debug task is fully shut down before the device resets its communication loop. The change only affects debug builds (not normal user devices) and appears designed to prevent a stale debug session from surviving across a loop restart. There is no direct evidence in the commit that this fixes an exploitable security vulnerability in production.

This commit finishes a previously incomplete feature in Trezor's new wireless pairing protocol (THP). Before the fix, the device told the connecting computer/phone its model variant as 'None' (effectively blank). After the fix, it correctly reports the device's color, whether it is a Bitcoin-only edition, and its packaging type. This is mostly a correctness/functional fix, but an incorrect or missing model variant could in theory confuse host software during pairing or cause it to trust the wrong device identity. There is no direct evidence in the commit of an exploitable vulnerability.

This commit is a user-interface refactor for Stellar transaction signing on Trezor hardware wallets. It changes the wording and order of confirmation screens, adds warnings when the transaction source account does not belong to the device, and streamlines how operation outputs are shown. There is no direct evidence in the diff of a security vulnerability; it appears to be a UX improvement. However, any change to what users confirm before signing deserves a careful look to ensure nothing important was removed or weakened.

This commit adds a new 'Regulatory certification' screen to the Trezor hardware wallet's user interface. It is purely a UI feature that displays certification marks (FCC, CE, RCM, etc.) and regional compliance information. There is no security-relevant code change, no handling of secrets, and no network or cryptographic logic.

This commit simplifies the Trezor hardware wallet's power-monitoring code by using one timer interval (100 ms) everywhere instead of two different intervals (100 ms and 300 ms). It removes a duplicate timer setting and renames the constant. There is no clear security bug being fixed; it appears to be a cleanup or consistency improvement in how often the device checks its battery and power state.

This commit adds a new on-device screen for changing the device's name (label) on the upcoming Trezor 'Eckhart' model. It also makes the passphrase input code more flexible by allowing the caller to specify the prompt text and maximum length, and it wires up a new 'Device name' menu item. There is no obvious security bug in the diff, but it is a large feature patch touching keyboard input, menu navigation, and device settings, so it carries normal implementation risks.

This commit adjusts how a Trezor hardware wallet's Bluetooth subsystem behaves after unexpected resets or state changes in its wireless companion chip (nRF). It makes pairing restart automatically if it was interrupted, stops advertising when no bonded peers exist, and ends pairing cleanly when a connection is established. These are robustness fixes to Bluetooth state management rather than obvious security patches, though poor BLE state handling can in principle create attack windows.

This commit changes how the Trezor T3W1 hardware wallet enters its bootloader. It shortens the required power-button hold from 3 seconds to 2 seconds, adds a new on-screen progress message telling the user to release the button, and moves the haptic buzz and display initialization to occur only after the user has committed to bootloader mode. The changes appear to be a user-experience and timing refinement rather than a fix for an exploitable security flaw. There is no vendor statement or independent report linking this commit to a security vulnerability.

This commit changes how a Trezor hardware wallet starts up when you press its button. Previously, the device would only fully power on after a long button press (about one second) or when in a special factory mode. After this change, a short button press is enough to start the device in normal use. The change also adds a small haptic buzz at 500 milliseconds to give the user feedback. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a user-experience or behavior change in the bootloader.

This commit fixes a subtle bug in the Trezor device's task scheduler where the same exception object was being reused for every timeout. In Python, exception objects carry state (such as a traceback). Reusing the same object across many tasks and timeouts could cause stale traceback or context information to leak between unrelated operations, or trigger unexpected behavior if code catches and inspects the exception. The fix creates a fresh Timeout exception each time one is needed.

This commit only updates expected visual test snapshots (hashes) for one PIN-cancel test on the T2T1 device across several languages. It changes no product code, no firmware logic, and no cryptographic behavior. There is no security issue here.

This commit only removes or rearranges blank lines in two C source files to make the code style consistent. No program logic, function calls, variable handling, or security behavior was changed.

This commit adds production-test commands for a new Tropic security chip in Trezor hardware wallets. It also finishes a previously stubbed secure-channel encryption routine and adds commands to read/write device certificates and keys. The changes are intended for the factory-provisioning environment (prodtest), not the end-user firmware, but they handle real cryptographic keys and chip configuration. There is no direct evidence of a vulnerability, but the code touches sensitive key material and includes hard-coded test keys and TODOs, so it warrants careful review.

This commit updates Trezor firmware to match a newer version of an external secure-chip library called libtropic. The main user-visible change is that a cryptographic signing function no longer takes a caller-supplied signature-buffer length; instead the firmware always uses a fixed, library-defined size. The patch also swaps the low-level random-number callback to a different API that the updated library expects. There is no claim in the commit that this fixes a security bug; it reads as a compatibility update after a dependency upgrade.

This commit simply updates an internal dependency (ts-tvl) from version 2.1 to 2.2 and adjusts a CI workflow path to match the new dependency's folder layout. There is no indication of a security fix, vulnerability, or malicious change in the visible diff.

This commit adds vibration feedback to the 'hold to confirm' animation on a specific Trezor hardware wallet layout (Eckhart). It only introduces haptic effects behind a compile-time feature flag and does not change security logic, transaction confirmation behavior, or access controls.

This commit adds a new low-level keep-alive/ping feature to the Trezor hardware wallet's experimental THP (Trezor Host Protocol) transport. It lets the host send a PING and the device reply with a PONG, echoing back a random 8-byte nonce. The change also updates test tooling to use this new transport-level ping instead of a higher-level application ping. There is no indication this fixes a security vulnerability; it appears to be a feature/refactoring change.

This commit is a simple code cleanup: it replaces a hardcoded number (50) with a named constant (`MAX_RETRANSMISSION_COUNT`) in the Python Trezor library. There is no functional change, no bug fix, and no security relevance visible in the diff.