Trezor firmware

This commit is a testing infrastructure change. It makes the software emulator automatically start a separate 'Tropic' hardware-security model on a configurable TCP port during automated tests, so multiple test workers can run in parallel without colliding on the same port. There is no indication this fixes or introduces a security vulnerability in the device firmware itself.

This commit only adds and updates automated tests for Trezor's device-authentication feature. It does not change the firmware code that runs on the device, so it cannot introduce a security vulnerability in the product itself. The tests verify that certificate chains and signatures from two hardware security chips (Optiga and Tropic) are accepted correctly.

This commit adds a build/test helper script and sample configuration files for simulating a Tropic security chip during automated testing. It does not change any firmware code that runs on real Trezor devices, and the private keys it includes are explicitly test-only artifacts copied from a public vendor example. There is no indication this is a security fix or that it introduces a vulnerability.

This commit only changes the project's automated testing configuration. It adds steps to start a 'Tropic' simulation model during certain CI test jobs for the T3W1 hardware model. There is no change to the firmware code that runs on user devices, no fix for a security flaw, and no indication this is a security-related patch.

This commit only adds a CI (continuous integration) option to display the 10 slowest automated user-interface tests during GitHub Actions runs. It does not change any firmware code, cryptography, device behavior, or test logic. There is no security relevance.

This commit updates three pre-built binary files for the T3W1 hardware model (bootloader, security monitor, and Bluetooth firmware) plus the matching bootloader hash header. The actual code inside the binary files is not shown in the diff, and the commit message only describes it as a routine binary update with no changelog. There is no visible security fix or vulnerability indicator in the materials provided.

This commit updates three pre-built binary files for the Trezor T3W1 hardware wallet model: the bootloader, a security monitor, and a Bluetooth Low Energy firmware image. It also updates the corresponding bootloader hash header so the firmware can verify the new bootloader. The commit message calls this a routine chore with no changelog entry. There is no description of any security fix, bug, or functional change in the commit itself, and the binary differences cannot be inspected as source code.

This commit fixes a crash that could occur when setting or changing the Trezor device's wipe code. The fix moves a memory-protection reconfiguration call to happen before user-interface progress is initialized. The crash appears to be a reliability bug rather than a security vulnerability that an attacker could exploit to steal funds or bypass protections.

This commit fixes a crash that could occur when setting or changing the Trezor device's wipe code (a special PIN that wipes the device). The fix moves a memory-protection reconfiguration call earlier, before user-interface progress initialization. The crash appears to be a reliability bug rather than a security vulnerability that would let an attacker steal funds, but a crash during security-sensitive wipe-code setup could disrupt the user experience or potentially be used in a denial-of-service scenario.

This commit restructures how the Trezor firmware initializes and starts secure sessions with the Tropic secure chip. Previously, session startup happened eagerly during device initialization. Now it is deferred until the first actual use of the Tropic chip, and a separate wait-for-ready step is added. The change is framed as a fix for a lazy session-start issue. It is not obviously exploitable by itself, but it touches security-critical pairing/session logic and removes a duplicate tropic_init() call in production-test code, which could matter if the duplicate call had side effects.

This commit removes one line of code that automatically brightened the screen when a Trezor device woke from sleep. The change is described as fixing a 'premature backlight fade-in' after wakeup. There is no indication in the commit that this was a security issue; it appears to be a user-experience or display bug fix.

This commit restructures how the Trezor device starts a secure session with its Tropic security chip. Previously, the device tried to initialize and immediately start a secure session during boot. Now it initializes the chip early but waits until the chip reports ready, and only starts the secure session when a function actually needs it. This is a defensive hardening change that reduces the chance of session-start commands failing or being issued while the chip is still booting. It also removes a duplicate initialization call in production-test code.

This commit removes a single line that automatically brightened the screen when a Trezor device woke up from suspend. The change is described as fixing a 'premature' backlight fade-in. There is no direct evidence in the commit that this is a security fix; it appears to be a user-experience or visual polish change. The security relevance, if any, would be minor: a brief screen illumination could theoretically reveal that the device had woken up or what screen was displayed, but no sensitive data or controls are exposed.

This is a small defensive fix inside the Trezor hardware wallet's user-interface code. It moves a debug-only sanity check so that it no longer fires when a screen layout simply returns nothing (None). Previously, the check could incorrectly raise a 'FirmwareError' before the code had a chance to notice there was no new button request. The change only affects debug builds and is unlikely to be directly exploitable by an attacker.

This is a small internal code cleanup in the Trezor firmware's user-interface layer. It moves responsibility for sending on-screen confirmation prompts (ButtonRequest messages) into a single place inside the Layout class, and removes an older helper function. There is no indication this change fixes a security bug or introduces a vulnerability; it is a refactoring to simplify the code.

This commit removes a try-except block that simply caught all exceptions and immediately re-raised them. It is a code cleanup with no functional change to how errors are handled.

This is a small internal cleanup in the Trezor firmware's user-interface code. It removes one of two calls to a function that shuts down other active workflows when a button request is sent. The change is labeled as a refactor with no changelog entry, and there is no direct evidence in the commit that it fixes a security bug.

This commit wraps two debug-only exception log statements with an `if __debug__:` guard. In Python, `__debug__` is true unless the interpreter is run with the `-O` (optimize) flag. The change prevents exception details from being logged in optimized/production builds. The patch is defensive and reduces information leakage, but the actual security impact is minor because the logged data is not shown to untrusted parties by default and the exceptions themselves are already being caught and suppressed.

This commit only changes a CI (continuous integration) test coverage threshold for one hardware model (T3B1) from 85% to 84%, with a TODO comment linking to an internal issue. It does not modify any firmware code, cryptography, or device behavior. There is no security-relevant change to the product itself.

This is a minor GitHub Actions workflow change. It ensures that a code-coverage report is uploaded even if earlier test steps failed. It does not change the Trezor firmware code, cryptography, or device behavior, and has no direct security relevance.

This commit only changes a test file used during automated testing. It swaps the cryptographic curve and private key used to generate fake payment-request signatures in tests, from Bitcoin's secp256k1 curve to the NIST P-256 curve. There is no change to the actual Trezor firmware or to how real payment requests are validated. It is a testing-only adjustment with no security relevance to end users.

This commit changes the cryptographic curve used to verify payment requests in Trezor firmware from secp256k1 (used by Bitcoin) to nist256p1 (also known as secp256r1, a standard government/enterprise curve). It also updates the built-in test public key to match the new curve. The change itself is a normal engineering update, but it touches code that protects payment request signatures, so it has minor security relevance.

This commit removes a step in the Trezor hardware wallet's Bluetooth pairing flow. Previously, when entering pairing mode, the device forcibly sent a disconnect notification, waited 300 milliseconds, and then disconnected any active Bluetooth connection. The patch skips that forced disconnect. The change could matter for security because sending a disconnect notification before pairing might have leaked that the device was about to pair, or the forced disconnect could have disrupted a secure session at a sensitive moment. However, the commit message gives no security explanation, so this is mostly a functional or UX fix.

This commit simply marks protobuf message type numbers 123 through 149 as reserved for future internal use. It is a routine development housekeeping change with no functional code changes and no security relevance.

This commit removes code that forcibly disconnected an active Bluetooth connection and sent a disconnect notification whenever the user entered Bluetooth pairing mode on a Trezor device. The change likely fixes a user-experience or minor security issue where entering pairing mode unnecessarily dropped an existing trusted connection, which could be disruptive or potentially exploitable in a social-engineering or pairing-confusion scenario. The patch is small and removes a deliberate disconnect step, but the commit message gives no explicit security context.