Trezor firmware

This commit is almost entirely a test-suite expansion for the Trezor Safe 7 device menu. It adds automated click tests for settings like auto-lock, device label, LED, haptic feedback, brightness, backup checks, notifications, menu traversal, and device wipe. A small amount of production code changed: a new 'led' field was added to the Features protobuf message so the device can report RGB LED support, and a few UI debug-trace strings were improved to make automated testing easier. There is no obvious security vulnerability in the diff.

This commit removes a 'virtual lock button' from the Trezor hardware wallet's home screen on the Eckhart layout. Previously, holding a finger anywhere on the home screen (except the bottom action bar) for a set duration could lock the device. Now that gesture is gone. The change is described as a feature tweak, not a security fix, and no security relevance is disclosed in the commit or supplied references.

This commit only increases version numbers across Trezor firmware components and translation files. There are no code changes that fix or introduce any security behavior, so it has no direct security relevance on its own.

This commit is a code cleanup that rewrites how the Trezor firmware talks to its Bluetooth chip. Instead of sending one big generic 'command' packet that could describe many different actions, the code now uses a separate, specific function for each Bluetooth action (such as turn on, pair, disconnect, erase bonds). The change also tightens the security boundary between the app and the kernel by validating the pairing name and pairing code directly, rather than trusting a caller-built command structure. There is no direct evidence in the commit that this fixes an active security bug, but the old design made it easier for a caller to request unintended operations by crafting command data, and the new design removes that entire class of mistakes.

This is a small bug-fix change in the Trezor Python command-line tools. It fixes a situation where the tool would keep using an old cached connection to the device while waiting for the device to reboot into bootloader mode. Now it clears that cached connection and tries to reconnect. There is no direct evidence this is a security vulnerability; it appears to be a reliability/usability fix for firmware updates.

This commit adds a visual LED effect and a short 'finalized' animation to the hold-to-confirm action on Trezor's newer Eckhart-style user interface. It changes when the device reports a confirmation: instead of confirming the instant the user releases the button, the device now waits for a brief 500 ms animation to finish. During that animation it ignores further button input and lights the RGB LED in a color matching the on-screen confirmation. There is no indication this fixes a security bug; it appears to be a user-experience and visual-feedback feature.

This commit fixes a bug in Trezor's T3W1 hardware wallet where, if a user first paired their device over USB instead of Bluetooth, the device failed to remember the computer/app name for later use. The fix makes sure the host and app name are saved during credential-based pairing even when there is no Bluetooth MAC address. There is no direct evidence this is a security vulnerability, but missing pairing metadata could weaken future security checks or user trust.

This update fixes a Bluetooth pairing screen bug in Trezor hardware wallets. Previously, if an already-paired (bonded) host device connected while the wallet was showing a pairing screen, the wallet did not automatically exit that screen. The fix adds a new internal event, 'pairing not needed,' so the user interface can close the pairing screen in that situation. The change is a user-experience and minor reliability fix; the commit itself does not describe a security vulnerability.

This commit fixes a potential integer overflow in the Trezor hardware wallet's storage code. A variable that holds a flash memory offset was declared as a 16-bit unsigned integer (uint16_t), which could overflow if the sector offset plus the amount of data already written exceeds 65,535. The fix widens that variable to a 32-bit unsigned integer (uint32_t), giving it enough room for larger flash addresses. If exploited, this kind of overflow could corrupt where data is written in the device's storage, potentially leading to data loss or unexpected behavior.

This commit is a routine user-interface redesign for the Trezor hardware wallet (specifically the T3W1/Eckhart layout). It moves the name of the connected app from the Bluetooth connection button onto a separate 'Host Info' screen, and adjusts how long text is clipped in buttons. There is no security-relevant change here.

This commit swaps out several pre-built binary files for the T3W1 hardware model: a newer bootloader version, a security monitor binary, and a Bluetooth firmware binary. The change is described as a routine chore with no changelog entry. Because the files are binary blobs, the actual code changes inside them cannot be inspected from the diff alone, and there is no stated security relevance.

This commit adds a new on-screen step to the Bluetooth pairing flow on Trezor hardware wallets. After the user confirms a pairing code, the device now shows a 'Waiting for host...' screen and waits for the host computer or phone to finish the pairing. It is a normal user-interface feature, not a fix for a known security bug.

This is a one-line Rust code cleanup that removes two unused color imports (GREY_LIGHT and an extra comma) to silence a Clippy compiler warning. It does not change any program behavior, user interface, or security logic.

This commit swaps in a new pre-built bootloader binary for the T3W1 hardware model used in QA/testing, and updates the matching cryptographic hashes that the firmware uses to recognize a valid bootloader. The actual source-code changes inside the bootloader are not shown, and the commit message gives no security explanation. On its own, this looks like a routine firmware housekeeping update, not a fix for a known security bug.

This commit adds informational notifications when a Trezor device is wiped or a Bluetooth pairing is removed. It does not change who can perform these actions or how they are authorized. The wipe/unpair logic itself already existed; the change only tells connected software that the event is happening. There is no obvious security vulnerability here.

This commit adds new notification messages that the Trezor device sends when certain things happen, such as locking/unlocking, changing settings, changing the PIN, or disconnecting from Bluetooth. It is a feature addition, not a fix for a known security bug. The change itself does not appear to introduce a vulnerability, though it slightly increases the amount of internal state information broadcast to other parts of the system.

This commit adds a new flag called firmware_corrupted to the device's Features message, which is sent to the host computer when the Trezor is in bootloader mode. Previously, the existing firmware_present flag only told the host whether any firmware was loaded, but its comment said 'valid firmware loaded.' The change makes the bootloader explicitly report whether the loaded firmware is corrupted, and it updates the comment on firmware_present to clarify it just means firmware is loaded. This is an informational/UX improvement, not a fix for a vulnerability in the device itself.

This commit is a straightforward code cleanup in the Trezor bootloader. It bundles three pieces of firmware information (vendor header, image header, and whether firmware is present) into a single struct and passes that struct around instead of three separate arguments. There is no change to security logic, no bug fix, and no new feature.

This commit adds a 10-second timeout to the Trezor bootloader's firmware update process. Previously, if the host computer stopped sending firmware pieces during an update, the bootloader could wait forever in a special update mode. The fix makes the device give up and show a failure screen if no next message arrives within 10 seconds. This is a hardening change: it reduces the window during which a device is stuck in a firmware-update state, which could matter if an attacker has physical or local access, but the commit itself does not describe a specific attack or vulnerability.

This commit tightens a data structure used during Trezor's new host pairing protocol (THP). It makes two text fields—host_name and app_name—mandatory instead of optional, and adds runtime checks that they are present before creating a pairing credential. On its own this is a defensive hardening change, not a fix for an active vulnerability. It reduces the chance that a paired host could be stored or shown to the user without an identifiable name, which could help prevent social-engineering or UI-confusion attacks.

This commit removes a small, unexplained workaround in the hardware wallet's random number generator code. The workaround previously added 4 extra bytes to a temporary buffer when generating randomness. The change makes the code cleaner and slightly more correct, but there is no indication it fixes an active security bug. It appears to be routine cleanup.

This commit is a visual design tweak for the Trezor hardware wallet's screen border. It changes how the decorative border is drawn so it sits exactly at the screen edges instead of being inset by one pixel. There is no security relevance: no cryptography, authentication, memory handling, or user-confirmation logic is changed.

This commit fixes a security bug in the Trezor hardware wallet's Bluetooth handling. When a user chose 'Forget all' Bluetooth pairings, the device was not clearing a special key used for a feature called THP (Trezor Host Protocol) credential authentication. As a result, after reconnecting, the device might trust the other side without asking the user to confirm again. The fix adds a call to invalidate that key whenever all Bluetooth pairings are erased.

This commit is a code cleanup: it removes unused title, description, and information parameters from the PIN/wipe-code setup confirmation flow and lets each device layout pick the correct text strings internally based on whether the user is setting a PIN or a wipe code. There is no obvious security bug introduced; it is a refactoring change with a [no changelog] tag.

This commit is a temporary hotfix that disables the Tropic secure-element randomness source in non-production builds to stop a Red Screen of Death (RSOD) crash triggered by the function rng_fill_buffer_strong. The change wraps the Tropic random-buffer mixing step in a PRODUCTION preprocessor guard, so it only runs in production firmware. In non-production/debug builds, the function will fall back to whatever other entropy sources remain (likely the STM32 hardware RNG plus optional optiga mixing). The commit message explicitly calls this a temporary fix and says to delete it later, so it is a workaround rather than a root-cause fix. There is no direct evidence in the commit that this is exploitable, but any change to cryptographic randomness generation in a hardware wallet is a security-sensitive signal.