Trezor firmware

This commit tunes the Bluetooth Low Energy settings on Trezor's Nordic BLE firmware. It asks for a faster connection interval, switches to the 2 Mbps physical layer, and adds suspend/resume functions that slow the connection when the device is idle. There is no direct security bug visible in the diff, but changing connection parameters can affect power, stability, and the attack surface for Bluetooth side-channel or denial-of-service attacks.

This commit is a routine UI code cleanup for the Trezor hardware wallet's on-screen menu. It splits one type of menu screen into two separate types—one for general submenus and one specifically for device-related options—so the code can use a shorter menu for device screens. There is no security fix or vulnerability here; it is purely a maintainability and layout refinement.

This commit is a routine user-interface change for the Trezor hardware wallet. It adds a small connection-status icon and a new 'Disconnected' label to buttons that represent Bluetooth Low Energy (BLE) paired devices. There is no security-relevant behavior change in the code.

This commit adds a new optional subtitle label to a vertical menu screen in the Trezor hardware wallet's user interface. It is a routine UI feature change with no apparent security relevance.

This commit updates the on-screen device menu for a new Trezor hardware wallet design (codename Eckhart). It adds Bluetooth pairing controls such as 'Connect', 'Forget', and 'Forget all', and wires some of those buttons to existing unpair/disconnect routines. The changes are almost entirely user-interface code; there is no obvious security bug, but several TODO comments show the underlying Bluetooth actions are still incomplete or mocked.

This commit is a straightforward feature addition: it exposes the Bluetooth Low Energy (BLE) address of the currently connected host (e.g., a phone or computer) to the Trezor device's application code. It does not change security policies, add authentication bypasses, or fix any vulnerability. It simply makes an already-recorded internal address available through a new API function.

This change makes the Trezor Bluetooth layer disconnect an active Bluetooth connection before erasing a paired-device bond. Without the disconnect, the device could remain connected to a host whose pairing keys have just been deleted, which may allow the host to keep interacting with the wallet after the user thought access was revoked.

This bootloader patch changes the order of operations during a factory reset (wipe). Previously, the device tried to delete Bluetooth pairing information ('bonds') before telling the host computer that the wipe succeeded. Deleting bonds can disconnect the device, so the success message might never reach the host, leaving the user or software unsure whether the wipe completed. The fix sends the success message first, then waits briefly, then deletes the bonds. This is primarily a reliability/UX fix; it does not appear to be a security vulnerability in the sense of theft or unauthorized access.

This commit removes the ability for Trezor's Bluetooth Low Energy (BLE) feature to maintain multiple simultaneous connections. It changes the firmware so the device only allows one BLE connection at a time, and wraps the old multi-connection logic in a compile-time flag that is no longer enabled. The change is described as a feature removal, not a security fix, and no security relevance is disclosed.

This commit increases the Bluetooth Low Energy (BLE) radio transmit power on Trezor's Nordic-based BLE firmware from a lower default level to +4 dBm. This is a one-line configuration change. It is not a code vulnerability in the traditional sense, but it marginally increases the physical range at which a nearby attacker could detect or attempt to interact with the device's BLE signal. The commit itself does not describe any security relevance and no security incident or advisory is supplied.

This commit is a feature addition, not a security fix. It changes how the Trezor hardware wallet's Bluetooth Low Energy (BLE) advertising data is structured so that a new flag can be broadcast when the user intentionally disconnected. This lets a paired computer or phone know not to automatically reconnect. There is no indication in the commit or supplied references that this resolves a vulnerability or security issue.

This commit exposes an existing Bluetooth security pairing/authentication function so it can be called by the main Trezor application (coreapp). It does not appear to fix a vulnerability; rather, it is a feature that lets the coreapp request authentication with the nRF Bluetooth chip. The change removes a compile-time restriction that previously limited the function to secure mode, adds a new system call, and adds a secure-monitor call for validating a pairing secret. Without additional context, this looks like a normal feature enabling secure Bluetooth pairing, not a security patch.

This commit adds the ability to unpair a specific Bluetooth device by its MAC address, instead of only being able to unpair whichever device is currently connected. It also exposes this function through the system call interface and a production-test command. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a feature improvement for managing paired devices.

This commit adds a new system call that lets the Trezor core application read the list of Bluetooth devices the hardware has bonded with. It is a feature addition, not a fix. The code includes a memory-access check before copying the bond list into the caller's buffer, which is the expected defensive pattern for this firmware's syscall layer. There is no direct evidence in the commit that this is a security patch or that it addresses a known vulnerability.

This commit adds a new system call that lets the main Trezor application read the firmware version of the nearby nRF Bluetooth chip. It is a small feature addition that exposes read-only version information; it does not, by itself, change how data is trusted or allow code execution.

This commit adds a new diagnostic command, 'ble-get-bonds', to Trezor's internal production-test firmware. It lets a factory technician read the list of Bluetooth devices previously paired with the device. The change is purely a feature addition for manufacturing/diagnostics; it does not, by itself, bypass pairing, steal funds, or change security settings. The main concern is that it exposes paired-device addresses (MAC addresses) through the production-test command-line interface, which could be a minor information-leak if the prodtest interface is accessible in the field.

This commit updates the battery fuel gauge code in Trezor hardware wallets so that it uses separate temperature lookup tables when the battery is charging versus when it is discharging. Previously, the same temperature table was used for both states. This is a routine calibration/modeling improvement, not a security fix.

This commit adjusts the tuning values for the battery fuel gauge's estimation filter in a Trezor hardware wallet. It changes how aggressively the device trusts its battery sensor measurements versus its internal battery model. There is no indication this is a security fix or introduces a security issue; it appears to be a routine calibration tweak for more accurate battery reporting.

This commit updates the battery fuel gauge calibration data for a specific Trezor hardware battery model. It changes temperature breakpoints and the mathematical coefficients used to estimate battery charge level from voltage readings. There is no indication this is a security fix; it appears to be a routine hardware characterization update.

This commit updates the battery fuel gauge calibration table for a specific Trezor battery model. It tweaks temperature points and the mathematical curves used to estimate charge level. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a hardware calibration/modeling correction. The title says it removes characteristics affected by temperature transition, suggesting an accuracy improvement rather than a security fix.

This commit updates the battery fuel gauge calibration table for a specific Trezor battery model. It replaces 4 temperature data points with 8 more detailed temperature profiles and adjusts the mathematical curves used to estimate battery charge level. There is no indication this change affects security, cryptography, user funds, or device integrity.

This commit adjusts internal tuning numbers for the battery fuel gauge in Trezor hardware wallets. It changes how the device estimates remaining battery charge, making the estimate smoother and less reactive. There is no indication this affects security, private keys, user data, or device integrity.

This commit adds a new Trezor feature that lets users derive a special cryptographic key (a SLIP-21 node) for a third-party storage framework called Evolu. The device will show an on-screen confirmation before releasing the key. It is a feature addition, not a fix for a known vulnerability. The main security consideration is that any host application able to send the new message type can request this key, but only after the user confirms on the device. The key is tied to a fixed path ("TREZOR"/"Evolu"), so it cannot be used to steal cryptocurrency directly, but if a user is tricked into approving it, the key could be leaked to a malicious application.

This commit is a purely cosmetic UI tweak for the Trezor hardware wallet. It increases the top padding of the home screen label from a theme-defined value to a fixed 38 pixels. There is no security relevance in the change itself.

This commit rewrites the on-screen keyboard used to type text into the Trezor Safe 5 (Eckhart layout). It renames the component, removes a separate confirmation screen for empty labels, lets users submit an empty string directly, and allows cancelling even when nothing has been typed. The change is described as a UI/UX cleanup, not a security fix. There is no direct evidence in the commit that it patches an exploitable vulnerability, but removing an extra confirmation step for empty device names slightly changes the safety surface around user input.