Trezor firmware

This commit adds support for SLIP-24 payment requests to Stellar transactions on Trezor devices. It lets a merchant or service provider attach a signed payment request to a Stellar transaction, which the device verifies and shows on screen before signing. The change is a feature addition, not a fix for a known vulnerability, and it includes safeguards such as rejecting payment requests that contain multiple operations.

This commit changes how the Bluetooth Low Energy (BLE) connection behaves on Trezor hardware. It adds a way to request a faster BLE connection (used in the bootloader to speed up firmware uploads) and a slower, more power-efficient mode for normal wallet use. The change is a feature, not a fix for a known vulnerability. There is no direct evidence in the commit that it addresses an active security flaw, but changing connection timing parameters can have side effects on wireless reliability and power use.

This commit only changes a test file. It adds a helper function to scroll through multi-page on-screen messages during automated PIN and wipe-code setup tests. There is no change to the actual Trezor firmware or wallet behavior, so it does not create or fix a security vulnerability in the product users rely on.

This commit updates a small Python helper script used to display a fingerprint (a kind of checksum) for Trezor firmware files. It adds support for a newer bootloader image format (BootloaderV2) so the tool can handle both old and new formats. There is no direct evidence this change fixes a security vulnerability; it appears to be a feature/robustness improvement for a developer tool.

This is a small build-tool change that makes a helper script print the correct cryptographic fingerprint for a special 'prodtest' firmware image. It does not change any code that runs on the Trezor device itself, does not introduce any security vulnerability, and is not described by the vendor as a security fix.

This commit removes automatic Debug printing support from several Rust data structures in the Trezor firmware's production builds, keeping it only for unit tests. It is a code hygiene or size-reduction change with no visible security relevance.

This commit swaps the cryptographic algorithm used for one of the Trezor hardware wallet's internal device-attestation keys from Ed25519 to ML-DSA-44, a post-quantum NIST-standardized signature scheme. It also enlarges the certificate storage area and doubles the production-test command-line input buffer. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as a planned cryptographic modernization change.

This commit updates Trezor's production-test firmware to accept multiple trusted public keys from secure hardware modules (HSMs) instead of just one. It also adds a helper function in the Noise crypto library that tries each trusted key in turn during a secure handshake. The change itself is a feature addition, not an obvious bug fix. However, the helper function restores a sensitive temporary key from a backup on every retry, which is good practice, and it wipes the backup when done. There is no direct evidence in the commit that this fixes a security vulnerability; it looks like operational hardening for factory testing.

This commit swaps in two new pre-built binary files for the T3W1 hardware model (a QA bootloader and a Bluetooth development firmware blob) and updates the matching SHA-256 hashes in a header file. The actual code inside the binaries is not shown in the diff, and the commit message gives no reason for the update. There is nothing here that directly demonstrates a security bug or fix.

This commit removes an unfinished 'Connect' button from the Bluetooth device menu on Trezor's upcoming Eckhart hardware model. The feature was only a placeholder (its handler contained a TODO comment and did nothing), so deleting it does not fix any active security bug. It is a routine cleanup change with no security relevance.

This commit removes a Bluetooth on/off button from the Trezor device's settings menu. The button was only a placeholder: it showed a confirmation dialog but did not actually change Bluetooth state. The change is described as a temporary UI cleanup because the underlying Bluetooth control API is not yet available. There is no security fix here.

This commit adds a new 'Power' menu to the Trezor Safe 7 (Eckhart) device interface, letting the user turn the device off, reboot it, or reboot into bootloader mode. It also adds a low-level 'hibernate' function to the power-management module. The changes are user-facing feature additions and do not appear to fix or introduce a security vulnerability on their own.

This commit makes a small change to the firmware update process for the nRF wireless chip inside some Trezor hardware wallets. It adds a one-second delay after writing the new firmware image, presumably to give the flash memory time to finish saving before rebooting the chip. The change is described as improving reliability, not fixing a security vulnerability. There is no direct evidence in the commit that this is exploitable or that it was caused by a security flaw.

This commit is a simple code cleanup: it moves the definitions of which physical pins control the RGB LED from a shared driver file into the board-specific header files for two Trezor T3W1 hardware revisions. The same pin numbers and ports are used, and no behavior changes. There is no security issue here.

This change adjusts how a Trezor hardware wallet hands off from its main app to its bootloader during a firmware upgrade. Previously, the device would wait until the host computer acknowledged the 'I am rebooting' message before rebooting. Now it waits at most 500 milliseconds and reboots anyway if the acknowledgment doesn't arrive in time. The goal is to avoid getting stuck if that final acknowledgment packet is lost in transit, similar to how a phone call can hang waiting for a goodbye that never comes. The patch is a partial fix for a reliability issue in the device-host communication protocol.

This commit adds a production-line safety check in Trezor's internal 'prodtest' firmware. Before writing a device-unique X.509 certificate to the device, the firmware now verifies that the certificate's subject serial number matches the device's own serial number stored in OTP. It also centralizes serial-number reading into a helper function. This is a hardening/validation improvement rather than a fix for an active user-facing vulnerability.

This commit changes how the Trezor hardware wallet displays a long device name in its settings menu. Previously, if the device name was too long to fit on screen, the firmware would trigger a fatal error in debug builds. The fix allows the name to overflow visually instead of crashing. There is no indication this is a security vulnerability; it is a UI robustness fix.

This commit is a UI layout fix for the Trezor hardware wallet's 'Eckhart' design. It renames and restructures how menu buttons handle long text labels so that certain items (like the device name) can overflow onto a single scrolling line instead of being forced into two lines. There is no indication this change fixes a security vulnerability; it appears to be a visual/UX improvement.

This commit adds a new build-time option called DBG_CONSOLE that lets developers choose how debug messages are output during firmware builds. It is a build-system change only—no actual device code is modified. By default it is empty/off, and in some non-production debug builds it automatically falls back to using the existing USB virtual COM port (VCP) for debug output. There is no direct security vulnerability in this change, but it makes debug-console support a configurable feature across bootloader, firmware, kernel, and other components.

This commit refactors how debug output is handled in Trezor firmware. It replaces direct USB virtual-serial and SWO debug output with a new 'debugging console' abstraction, adds optional read support, and exposes it to less-privileged application code through system calls. The change is described by the vendor as a refactor with no changelog entry. It does not by itself create a known exploit, but it widens the attack surface by making a debug channel readable and writable from user-space firmware, which could matter if the feature is enabled in production or combined with other bugs.

This commit is a straightforward code reorganization: it moves the Segger SystemView debugging subsystem from one directory to another inside the Trezor firmware source tree. It does not change any security-sensitive behavior, fix a bug, or alter how the device protects secrets. The feature remains disabled by default and is only useful when a developer attaches a debugger.

This is a large internal refactoring of the Trezor firmware's USB driver layer. It replaces direct USB class-specific read/write APIs (for HID, VCP, and WebUSB) with a unified 'system handle' API, centralizes USB interface setup in a new configuration module, and adjusts memory layout for one model. The commit is tagged as a refactor with no changelog and makes no direct claim of fixing a security bug. While the change touches security-relevant code paths (USB communication between the device and host), the diff itself shows a restructuring rather than a clear vulnerability fix or introduction.

This commit swaps in new pre-built binary files for the T3W1 hardware model's bootloader and Bluetooth firmware, plus updates the matching hash table. The actual code inside those binaries is not shown, so we cannot tell from this diff alone whether the change fixes a bug, adds a feature, or is purely routine. There is no mention of security in the commit message.

This commit adds a new 'battery state of charge' (SoC) field to the device's Features message, which is the information a Trezor reports about itself when asked. It is a straightforward feature addition: the bootloader now reads the battery level from the power manager and includes it in the device description sent to connected computers and phones. There is no indication this change fixes or introduces a security vulnerability.

This commit is a routine build-system change for the Trezor hardware wallet firmware. It prepares the build scripts to include either a development or production Bluetooth (nRF) chip binary depending on whether a development bootloader is being used. No security vulnerability is visible in the code change itself.