Trezor firmware

This commit only adds a plain-language comment (docstring) explaining what the ThpContext class does. No code behavior was changed, so it cannot introduce or fix a security issue on its own.

This commit is a simple rename of a Bluetooth interface class from 'BleInterface' to 'BLEIF' to match the naming style of 'USBIF'. It only changes names in code comments, type stubs, and internal identifiers. No behavior changes, no security fixes, and no security risks are present.

This change adjusts how a Trezor hardware wallet hands off from its main app to its bootloader during a firmware upgrade. Previously, the device would wait until the host computer acknowledged the 'I am rebooting' message before rebooting. Now it waits at most 500 milliseconds and reboots anyway if the acknowledgment doesn't arrive in time. The goal is to avoid getting stuck if that final acknowledgment packet is lost in transit, similar to how a phone call can hang waiting for a goodbye that never comes. The patch is a partial fix for a reliability issue in the device-host communication protocol.

This commit fixes a hard-coded Bluetooth Low Energy (BLE) interface identifier in the Trezor hardware wallet firmware. The old code used a fixed number (8) with a comment saying it should be replaced by the proper system handle. The fix now uses the correct generated constant. Using the wrong identifier could cause the BLE communication interface to be misidentified, which might lead to communication errors or, in a worst-case security scenario, allow an attacker to confuse the device about which channel data is arriving on. The change is small and defensive, but the commit message gives no details about any actual security issue.

This commit only adds new automated tests for the Trezor hardware wallet's THP (Trezor Host Protocol) transport layer. It checks that the device correctly rejects old protocol v1 packets and unallocated channel messages. No production firmware code is changed, so this commit does not introduce or fix a security vulnerability by itself.

This commit rewrites how the Trezor firmware handles the new Trezor Host Protocol (THP) across USB and Bluetooth. Instead of running one independent session handler for each interface, it merges them into a single task that can switch attention between interfaces. The main goal is to let the device abandon ('preempt') a stuck or unresponsive THP channel so that another interface can still make progress. The change is described as a feature/refactor, not as a security fix, and one THP test file is removed to be rewritten later.

This commit adds a production-line safety check in Trezor's internal 'prodtest' firmware. Before writing a device-unique X.509 certificate to the device, the firmware now verifies that the certificate's subject serial number matches the device's own serial number stored in OTP. It also centralizes serial-number reading into a helper function. This is a hardening/validation improvement rather than a fix for an active user-facing vulnerability.

This commit adds a verification step in the Trezor hardware wallet's factory production-test tool before writing a device certificate to secure storage. It now checks that the supplied certificate chain is cryptographically valid and matches the device's own MCU authentication key, preventing a malformed or mismatched certificate from being permanently written during manufacturing.

This commit removes extra Bluetooth address-type information from two Python-facing functions in the Trezor firmware. Previously, these functions returned both a 6-byte Bluetooth address and an integer indicating whether the address was public or random. Now they return only the 6-byte address. The change is described as a routine cleanup ('chore') with no changelog entry. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be an API simplification.

This commit updates the Bluetooth device menu on Trezor hardware wallets to display real paired-device MAC addresses instead of a hardcoded placeholder name ('Trezor Suite'). It is a UI feature change with no apparent security relevance.

This commit is a UI layout fix for the Trezor hardware wallet's 'Eckhart' design. It renames and restructures how menu buttons handle long text labels so that certain items (like the device name) can overflow onto a single scrolling line instead of being forced into two lines. There is no indication this change fixes a security vulnerability; it appears to be a visual/UX improvement.

This commit changes how the Trezor hardware wallet displays a long device name in its settings menu. Previously, if the device name was too long to fit on screen, the firmware would trigger a fatal error in debug builds. The fix allows the name to overflow visually instead of crashing. There is no indication this is a security vulnerability; it is a UI robustness fix.

This commit fixes a bug in the Unix emulator for Trezor's USB virtual serial port (VCP). Previously, after reading part of a message, the emulator would erase the entire buffer and reset the length to zero, even if unread data remained. Now, for VCP interfaces, it correctly keeps the unread portion of the message for the next read. This is a correctness fix in emulator code, not the real device firmware, and there is no direct evidence it is security-relevant or exploitable.

This commit fixes a data structure bug in the production-test emulator for Trezor hardware wallets. The code previously stored a list of pointers to command definitions, but used the wrong size when growing the list and then dereferenced it incorrectly. The fix stores the command definitions directly in the list and uses the correct size. This is a straightforward bug fix in an internal testing tool; there is no direct evidence it is an exploitable security vulnerability.

This commit moves a small 16-byte 'lock slot' region from the middle of a storage sector to the very end of that sector in the T3W1 hardware model's secret memory layout. The change is a single offset value. It is likely a defensive hardening measure to prevent the lock slot from being accidentally overwritten by other data placed earlier in the same sector, but the commit message gives no explicit security rationale.

This commit adds a new factory-testing command, tropic-keyfido-read, to the Trezor device's production-test firmware. The command lets an authorized tester read out the FIDO attestation public key stored on the Tropic secure chip. It is a read-only diagnostic feature and does not, by itself, expose private keys or change device state. The main security consideration is that it adds another surface in the already-privileged prodtest environment, but it appears consistent with existing read commands and uses the same masking/unmasking pattern.

This commit adds a new build-time option called DBG_CONSOLE that lets developers choose how debug messages are output during firmware builds. It is a build-system change only—no actual device code is modified. By default it is empty/off, and in some non-production debug builds it automatically falls back to using the existing USB virtual COM port (VCP) for debug output. There is no direct security vulnerability in this change, but it makes debug-console support a configurable feature across bootloader, firmware, kernel, and other components.

This commit is a straightforward code reorganization: it moves the Segger SystemView debugging subsystem from one directory to another inside the Trezor firmware source tree. It does not change any security-sensitive behavior, fix a bug, or alter how the device protects secrets. The feature remains disabled by default and is only useful when a developer attaches a debugger.

This commit refactors how debug output is handled in Trezor firmware. It replaces direct USB virtual-serial and SWO debug output with a new 'debugging console' abstraction, adds optional read support, and exposes it to less-privileged application code through system calls. The change is described by the vendor as a refactor with no changelog entry. It does not by itself create a known exploit, but it widens the attack surface by making a debug channel readable and writable from user-space firmware, which could matter if the feature is enabled in production or combined with other bugs.

This is a large internal refactoring of the Trezor firmware's USB driver layer. It replaces direct USB class-specific read/write APIs (for HID, VCP, and WebUSB) with a unified 'system handle' API, centralizes USB interface setup in a new configuration module, and adjusts memory layout for one model. The commit is tagged as a refactor with no changelog and makes no direct claim of fixing a security bug. While the change touches security-relevant code paths (USB communication between the device and host), the diff itself shows a restructuring rather than a clear vulnerability fix or introduction.

This commit fixes a Bluetooth pairing behavior in Trezor hardware wallets. Previously, if the device was left in 'pairing mode' (which advertises to and accepts new devices), a connection from an already-bonded/trusted device could keep it stuck in pairing mode instead of exiting it. The fix detects bonded connections and ends pairing mode when one connects. Staying in pairing mode longer than intended could let a nearby attacker pair with or interact with the device while the user thinks it is only reconnecting to a known device.

This commit adds a new read-only function that lets the device's MicroPython code ask the Bluetooth chip for the list of currently paired/bonded devices. It only exposes information that was already stored inside the device; it does not change pairings, bypass authentication, or alter any security behavior. By itself, this is a feature addition with very low security risk.

This is a minor code cleanup in the Trezor firmware's Bluetooth module. A developer moved a small chunk of repeated code—creating an empty Bluetooth address—into a reusable helper method. The behavior of the program is unchanged; it is purely a refactoring for readability and maintainability.

This commit swaps in new pre-built binary files for the T3W1 hardware model's bootloader and Bluetooth firmware, plus updates the matching hash table. The actual code inside those binaries is not shown, so we cannot tell from this diff alone whether the change fixes a bug, adds a feature, or is purely routine. There is no mention of security in the commit message.

This commit disables a request that tells nearby Bluetooth Low Energy devices to use a faster 2 Mbps radio mode ('2M PHY') right after a connection is established. The change is presented as a fix for Nordic hardware, but the commit message gives no security explanation. It may be a stability or compatibility workaround rather than a security patch.