What the developer wrote
Authored by tychovrahe
feat(core/ble): remove BLE multipoint
[no changelog]
What changed, and why it matters
This commit removes the ability for Trezor's Bluetooth Low Energy (BLE) feature to maintain multiple simultaneous connections. It changes the firmware so the device only allows one BLE connection at a time, and wraps the old multi-connection logic in a compile-time flag that is no longer enabled. The change is described as a feature removal, not a security fix, and no security relevance is disclosed.
Treat as a hardening/feature-simplification change rather than an urgent security patch. If maintaining a fork, verify that `BLE_MULTIPOINT` is not inadvertently enabled and that single-connection behavior does not break intended pairing workflows. No immediate user action is required based solely on this commit.
Security signals we found
Reduction of attack surface by limiting BLE to a single concurrent connection
Removal of multi-peer connection state transitions that could be a source of bugs
No explicit security bug fix language in commit message or diff
Compile-time feature flag (BLE_MULTIPOINT) preserves code but disables it by default
Evidence from the diff
The patch disables BLE ‘multipoint’ support in Trezor firmware. In core/embed/io/ble/stm32/ble.c, logic that transitions the BLE driver to BLE_MODE_CONNECTABLE when more than one peer is present is now guarded by #ifdef BLE_MULTIPOINT, with the non-multipoint path always requesting BLE_MODE_KEEP_CONNECTION. A second block that forced BLE_MODE_CONNECTABLE when peer_count > 1 is also removed unless BLE_MULTIPOINT is defined. In nordic/trezor/trezor-ble/prj.conf, CONFIG_BT_MAX_CONN is reduced from 2 to 1. The commit message is a feature removal with ‘[no changelog]’.
Changed components
Trezor Core BLE driver (core/embed/io/ble/stm32/ble.c)Nordic Zephyr BLE project configuration (nordic/trezor/trezor-ble/prj.conf)Inspect captured patch +7 / −1
diff --git a/core/embed/io/ble/stm32/ble.c b/core/embed/io/ble/stm32/ble.c
index 163620975..5986ffa7f 100644
--- a/core/embed/io/ble/stm32/ble.c
+++ b/core/embed/io/ble/stm32/ble.c
@@ -222,11 +222,15 @@ static void ble_process_rx_msg_status(const uint8_t *data, uint32_t len) {
}
if (drv->mode_current != BLE_MODE_PAIRING) {
+#ifdef BLE_MULTIPOINT
if (msg.peer_count > 1) {
drv->mode_requested = BLE_MODE_CONNECTABLE;
} else {
drv->mode_requested = BLE_MODE_KEEP_CONNECTION;
}
+#else
+ drv->mode_requested = BLE_MODE_KEEP_CONNECTION;
+#endif
}
} else {
// connection lost
@@ -279,9 +283,11 @@ static void ble_process_rx_msg_status(const uint8_t *data, uint32_t len) {
drv->mode_current = BLE_MODE_OFF;
}
+#ifdef BLE_MULTIPOINT
if (drv->mode_current == BLE_MODE_KEEP_CONNECTION && drv->peer_count > 1) {
drv->mode_requested = BLE_MODE_CONNECTABLE;
}
+#endif
drv->busy_flag = msg.busy_flag;
drv->peer_count = msg.peer_count;
diff --git a/nordic/trezor/trezor-ble/prj.conf b/nordic/trezor/trezor-ble/prj.conf
index c58e007de..61e97a577 100644
--- a/nordic/trezor/trezor-ble/prj.conf
+++ b/nordic/trezor/trezor-ble/prj.conf
@@ -42,7 +42,7 @@ CONFIG_BT_DEVICE_NAME="Trezor BLE"
CONFIG_BT_DEVICE_NAME_DYNAMIC=y
CONFIG_BT_DEVICE_APPEARANCE=128
CONFIG_BT_COMPANY_ID=0x0F29
-CONFIG_BT_MAX_CONN=2
+CONFIG_BT_MAX_CONN=1
CONFIG_BT_MAX_PAIRED=8
CONFIG_BT_SMP=y
CONFIG_BT_SMP_ENFORCE_MITM=y
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.