Trezor firmware

This commit adds a new power-saving feature: pressing the physical power button on a Trezor device can now suspend the firmware. If the device has a PIN and is currently unlocked, the button press first locks the device (ending any active workflow) and then triggers a shutdown. Otherwise, the device is suspended and later woken up. The change is a feature addition, not a fix for a known security bug, and there is no evidence in the commit or supplied references that it addresses a vulnerability.

This commit doubles the stack memory size for the Trezor hardware wallet's production-test firmware from 12 KB to 24 KB. A stack that is too small can cause crashes (the commit notes 'Overflow causes UsageFault'). There is no direct evidence in the commit that this is exploitable as a security vulnerability, and the change appears to be a stability fix for a special manufacturing/QA mode rather than the normal user-facing wallet firmware.

This commit is a routine build/dependency housekeeping change. It updates Python version constraints and the internal 'trezor' package version requirement so that the project's Poetry lock file can be regenerated without conflicts. There is no indication this fixes a security vulnerability or changes runtime behavior of the Trezor firmware or wallet software.

This commit changes the vibration pattern that the Trezor hardware wallet produces when it powers on. It adds a new dedicated 'power on' haptic effect and uses it instead of reusing the existing button-press vibration. There is no security relevance in this change.

This commit finishes a previously stubbed-out feature in Trezor's core firmware: automatic retransmission of lost USB packets during a secure protocol called THP. Before this change, the code had a TODO comment where retransmissions should have been. After this change, the device will resend a packet up to 50 times with an increasing timeout if it does not receive an acknowledgment. This is a normal reliability improvement, but because it touches low-level packet handling and timeout logic, it could introduce subtle bugs such as the device hanging, retrying forever in edge cases, or misinterpreting a delayed packet as a fresh one.

This is a test-only change that replaces a fixed 0.1-second sleep with an explicit device-readiness check before starting screen recordings in UI tests. It does not touch firmware, wallet logic, cryptography, or any production code path, so it has no direct security relevance for end users.

This is a test-only change for the Trezor hardware wallet firmware. It adds a small cleanup step in the debug/test code path that waits for a debug-link helper task to finish before restarting the event loop used by the new THP (Trezor Host Protocol) code. It does not change normal user-facing behavior and is not a security fix for a live vulnerability.

This commit is a large internal refactor of the Trezor firmware's THP (Trezor Host Protocol) event loop and message handling. It removes an old global buffer-locking scheme and a separate retransmission task, replacing them with per-channel buffer objects and a simpler synchronous send-and-wait-for-ACK flow. The change also removes the old `loop.clear()` restart-on-error behavior in favor of explicitly joining workflows before restarting. The diff itself is a feature rewrite with no explicit security claims, but it touches sensitive code paths (encrypted channel setup, session scheduling, buffer management) and removes some safety checks, so it should be reviewed carefully for regressions.

This is a one-line fix in Trezor's factory production-test code for the Tropic secure chip. It changes a preprocessor condition from an apparently wrong/placeholder macro name 'ABAB' to the intended 'TROPIC_TESTING_KEYS'. The effect is to ensure that testing-only cryptographic keys are compiled in only when the proper configuration flag is set, rather than under an unrelated or accidental flag. This reduces the risk that production devices could be built with test keys instead of real factory keys.

This commit fixes a command in Trezor's production-test firmware that checks how many arguments a user passed. The old check rejected commands with more than zero arguments, but accidentally allowed commands with zero arguments through. The fix requires exactly one argument. The affected command is part of a low-level factory/testing tool, not the normal wallet firmware users run every day.

This commit fixes the formatting of a debug/production-test command output for a wireless charging chip. It changes how numbers are printed (decimal to hexadecimal) and moves the data values from a 'PROGRESS' line to the 'OK' line. There is no security issue here—it's a cosmetic/output-formatting fix in a factory testing tool.

This commit fixes a minor formatting bug in the Trezor production-test command-line tool. Previously, every response line in non-interactive mode had an extra blank line (CRLF) appended. The change moves that blank line so it only appears in interactive mode, where it serves as a prompt separator. There is no security relevance in the commit or diff.

This commit is a simple code cleanup: it removes a small helper method and places its contents directly into the function that called it. No behavior changes, no security fixes, and no new risks are visible.

This commit removes a single leftover debug logging line that printed the contents of a channel allocation packet. It is a cleanup change with no security relevance: the log line was informational, not an error, and removing it does not fix a vulnerability or change any behavior an attacker could exploit.

This is a small code cleanup in Trezor's Python library for a newer transport protocol (THP). It changes a helper function so it returns 'no sequence bit' for message types that don't carry one, and adds an assertion to catch any unexpected case. The change is labeled a refactor with no changelog and appears defensive rather than a fix for an active security bug.

This commit changes the Trezor Python library's handling of messages sent over the new THP (Trezor Host Protocol) transport. Previously, if a message had a bad checksum, the code would read a new message but did not track whether the newly received message was a fresh one or an old retransmission. The new code loops until it receives a message that passes the checksum and also has the expected sequence/sync bit, ignoring stale or out-of-order retransmissions. This is a hardening change: it makes the host-side protocol implementation more robust against duplicate or replayed packets, which could otherwise confuse state machines or cause commands to be processed twice.

This is a small cleanup change in the Trezor firmware's internal message-handling loop. It makes sure a special developer/debug task is fully shut down before the device resets its communication loop. The change only affects debug builds (not normal user devices) and appears designed to prevent a stale debug session from surviving across a loop restart. There is no direct evidence in the commit that this fixes an exploitable security vulnerability in production.

This is a one-line internal code cleanup in Trezor's task scheduler. It changes how a background racing task is advanced, switching from a public scheduling function to a direct internal stepping call. There is no visible security problem in the diff itself, and no security context is provided by the vendor.

This commit changes internal test-only debug code in the Trezor firmware so that the debug communication session can be cleanly shut down between test scenarios. It adds a flag, a mailbox signal, and a timeout-based join to prevent the debug task from getting stuck when the test framework restarts the device's event loop. The production security relevance appears low because the code is wrapped in `if __debug__` and only used during automated UI tests.

This commit finishes a previously incomplete feature in Trezor's new wireless pairing protocol (THP). Before the fix, the device told the connecting computer/phone its model variant as 'None' (effectively blank). After the fix, it correctly reports the device's color, whether it is a Bitcoin-only edition, and its packaging type. This is mostly a correctness/functional fix, but an incorrect or missing model variant could in theory confuse host software during pairing or cause it to trust the wrong device identity. There is no direct evidence in the commit of an exploitable vulnerability.

This commit is a user-interface refactor for Stellar transaction signing on Trezor hardware wallets. It changes the wording and order of confirmation screens, adds warnings when the transaction source account does not belong to the device, and streamlines how operation outputs are shown. There is no direct evidence in the diff of a security vulnerability; it appears to be a UX improvement. However, any change to what users confirm before signing deserves a careful look to ensure nothing important was removed or weakened.

This commit adds a new 'Regulatory certification' screen to the Trezor hardware wallet's user interface. It is purely a UI feature that displays certification marks (FCC, CE, RCM, etc.) and regional compliance information. There is no security-relevant code change, no handling of secrets, and no network or cryptographic logic.

This commit simplifies the Trezor hardware wallet's power-monitoring code by using one timer interval (100 ms) everywhere instead of two different intervals (100 ms and 300 ms). It removes a duplicate timer setting and renames the constant. There is no clear security bug being fixed; it appears to be a cleanup or consistency improvement in how often the device checks its battery and power state.

This commit adds a new on-device screen for changing the device's name (label) on the upcoming Trezor 'Eckhart' model. It also makes the passphrase input code more flexible by allowing the caller to specify the prompt text and maximum length, and it wires up a new 'Device name' menu item. There is no obvious security bug in the diff, but it is a large feature patch touching keyboard input, menu navigation, and device settings, so it carries normal implementation risks.

This commit adjusts how a Trezor hardware wallet's Bluetooth subsystem behaves after unexpected resets or state changes in its wireless companion chip (nRF). It makes pairing restart automatically if it was interrupted, stops advertising when no bonded peers exist, and ends pairing cleanly when a connection is established. These are robustness fixes to Bluetooth state management rather than obvious security patches, though poor BLE state handling can in principle create attack windows.