Trezor firmware

This is a large internal code reorganization in Trezor's embedded firmware. It moves flash/storage headers and build flags around so different firmware images (bootloader, kernel, production test, etc.) declare more explicitly which features they need. There is no obvious security bug introduced, but the change touches low-level memory-layout and storage code, so any mistake could in principle affect how secrets are stored. The commit itself is labeled a refactor and includes no changelog.

This commit is a code cleanup: it renames the 'entropy' module to 'storage_salt' and moves it into the storage subsystem. The same device-unique salt logic (CPU ID plus one-time-programmable randomness block, or a master-key-derived salt on newer devices) is preserved, just called at a different point during storage setup rather than at boot. There is no indication this fixes a security bug or changes cryptographic behavior.

This commit is a code cleanup and refactoring change in Trezor firmware. It replaces the old storage_init() function, which required callers to fetch their own random entropy (salt), with a new storage_setup() helper that fetches entropy internally. It also removes the direct entropy_get() system call from the non-secure kernel interface. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be architectural preparation for future initialization changes.

This commit simply removes an unused compiler flag named USE_SVC_SHUTDOWN from the firmware build script. There is no functional code change, no bug fix, and no security-relevant behavior altered. It is a routine cleanup.

This commit simply deletes a leftover translation diff file that had been accidentally added to the repository earlier. It contains only string/label changes for user interface text and does not modify any executable code, cryptographic logic, or security behavior. There is no security issue here.

This commit adds a factory-testing command that can rewrite the boardloader (the very first startup code on the device). It is intentionally restricted to development/non-production builds and excluded from the T2T1 model. The change also makes the shared binary buffer 4-byte aligned and adds a new memory-protection mode so the boardloader flash region can be written during this test command.

This commit simply deletes an internal developer/reflashing utility called 'reflash' from the Trezor firmware source tree. It removes the build rules, linker script, and source code that allowed writing the boardloader and bootloader from an SD card. There is no patch to any runtime security boundary, no disclosed vulnerability, and no evidence this change fixes an exploitable bug.

This commit is a routine developer tooling refactor. It renames and generalizes an internal Python helper script used to upload firmware to Trezor hardware over a USB serial port, so it can handle both nRF chip updates and boardloader updates. There is no change to device firmware, no user-facing feature, and no security fix or vulnerability indicated in the diff or commit message.

This commit only updates a README documentation file for an internal production-testing tool. It adds a sentence telling users which helper scripts to run when updating bootloader and nRF firmware binaries. No code, build scripts, firmware logic, or security behavior was changed.

This commit is a code cleanup that merges two nearly identical firmware-update helpers into one shared function. There is no indication it fixes or introduces a security bug; it is a routine refactoring in an internal production-testing tool.

This commit is a routine translation and font maintenance update. It regenerates Spanish and Portuguese font glyph data for the 'º' character, updates translation string files, refreshes the translation signature, and updates UI test fixture hashes. There is no code that handles secrets, cryptography, network data, or user authorization, and nothing in the commit suggests a security fix or vulnerability.

This commit simply removes font files (TTF/OTF) and their license text from the repository, moving them to a separate fonts-only repository. It does not change any device firmware code, cryptographic logic, or user-facing behavior. There is no security issue here.

This commit is a code cleanup (refactor) inside the Trezor firmware's THP (Trezor Host Protocol) transport layer. It moves packet-fragmentation logic into a new helper method, removes an old writer module, and makes all sending paths use a single context method. There is no indication in the commit or supplied references that this fixes a security bug; it appears to be a maintainability improvement only.

This commit simply exposes an existing secure memory-clearing function to more parts of the Trezor firmware. It does not fix a bug or change behavior users can observe. It is a routine code cleanup (a 'chore') with no direct security impact on its own.

This commit fixes a minor memory-management issue in the Trezor hardware wallet's user-interface code. Previously, the same `Shutdown` exception object was reused every time a screen layout shut down. Each reuse attached a new traceback to that same object, causing the stored traceback chain to grow indefinitely. The fix creates a fresh exception object each time, so old tracebacks can be garbage-collected. This is a cleanup/robustness fix rather than a clear, exploitable security vulnerability.

This commit fixes a subtle bug where the same error object was reused every time a forbidden key path was accessed. In Python/MicroPython, reusing a single exception instance can cause problems if something later modifies or inspects the raised error, because the same object carries state from one error site to another. The fix creates a fresh exception object each time, which is safer and more correct, but the commit message and diff do not clearly describe an active security vulnerability.

This commit simply removes debug-only logging statements from a low-level Trezor firmware communication helper. There is no change to actual device behavior, no security fix, and no vulnerability introduced.

This is a tiny internal test-only change. It gives a default value to a fake USB-like object used only in automated tests, so callers no longer need to pass a placeholder number. It does not touch any real device code, user-facing behavior, or security logic.

This is a code cleanup (refactor) that reorganizes how the Trezor hardware wallet handles its newer THP (Trezor Host Protocol) communication. It moves logic from a loose module into a class called ThpContext, similar to how the older protocol is already structured. There is no indication in the commit that this fixes a security bug; it is described as an internal restructuring with no user-facing changelog entry.

This commit simply deletes an unused helper module that translated between USB/Bluetooth connection identifiers and internal wire interface objects. There is no security-relevant change; it is routine code cleanup.

This commit is a minor cleanup in Trezor's test code. It fixes a spelling mistake in a helper function name and changes how debug logging is silenced during automated tests. It does not affect the actual device firmware or any user-facing security behavior.

This commit adjusts when a firmware feature called 'ui_debug_overlay' is enabled during the build process. Previously, it was enabled for all optimized builds (PYOPT), which likely includes production releases. Now it is only enabled alongside other debug features when debug mode (PYOPT='0') is active. The change prevents a debug UI overlay from being compiled into production firmware.

This commit is a code cleanup: it moves the logic that reassembles incoming message packets into a new helper class called Reassembler. The change simplifies the Channel class and removes some duplicated code, but it does not appear to fix or introduce a security vulnerability. There is no changelog entry and no security disclosure attached.

This commit removes a temporary fallback mechanism from the Trezor hardware wallet's core firmware. The fallback feature was used during encrypted communication when normal memory buffers were busy. The commit message says it will be reimplemented later after internal refactoring. There is no indication in the commit itself that this fixes a security vulnerability; it appears to be a routine cleanup of unfinished code.

This commit adds a debug-only testing feature that lets automated tests wipe a Trezor device through the DebugLink interface without first unlocking it. It is intended to make testing easier for newer Trezor devices that use the THP protocol. The change only affects debug builds and is not present in production firmware, so it does not directly endanger real users. However, it does add a path where a debug build can erase the device without authentication, which is a security-relevant design choice for test/debug environments.