Trezor firmware

This commit fixes a bug in the tool that builds Trezor hardware wallet flash images. Previously, when combining the boardloader, bootloader, and firmware into one file, later sections were placed too early because earlier files were smaller than their reserved flash space. The fix pads the gaps with zeros so each piece lands at its correct memory address, preventing the resulting image from failing to boot. It is a build-time tooling fix, not a runtime vulnerability in the device itself.

This commit is a straightforward build-system cleanup. It removes special-case layout feature bundles (like layout_bolt_d001 and layout_bolt_d002) and replaces them with separate, explicit display-type features (display_mono, display_rgb565, display_rgba8888). Model configuration files now list the display type directly alongside the layout type. There is no change to runtime code, no bug fix, and no security-related behavior.

This commit fixes a minor user-interface wording issue in Trezor's Solana app. Previously, the device built the cosigner label by manually combining the word 'Cosigner' with a number, which could cause problems for translations. Now it uses a proper translation template 'Cosigner {0}'. There is no direct evidence this is a security vulnerability, but inconsistent or untranslatable labels could theoretically contribute to user confusion when reviewing multisig signers.

This commit fixes a labeling mistake in the Trezor firmware's protocol definition: eleven Monero request messages were incorrectly marked as traveling from the device to the host, when in reality the host sends them to the device. The change only updates metadata in generated host-side descriptors; the firmware itself does not use this metadata, so on-device behavior is unchanged. It is a correctness fix for host libraries, not a patch for an exploitable device bug.

This commit is a routine cleanup: it removes two old, already-deprecated fields from the messages that Trezor devices and apps use to exchange passphrase information. The fields were marked deprecated in firmware version 2.3.0 and are no longer used. Removing them does not change active behavior and does not fix or introduce a security vulnerability.

This commit is a routine cleanup: it removes two old, already-deprecated message types related to passphrase handling from Trezor's protocol definitions and generated code. There is no security fix or vulnerability being patched here; the messages were marked deprecated years ago and are now being deleted entirely.

This is a minor code cleanup in the Rust Trezor client. It simplifies how the software responds when a Trezor device asks for a passphrase. The old code checked whether the device wanted the passphrase entered on the device itself; now it always tells the device to enter the passphrase on the host computer. The commit message says the on-device path is deprecated and no longer used. There is no security-relevant change visible in the diff.

This commit undoes a previous change in the Trezor client Rust library. The original change made the software send an empty passphrase when using standard (non-hidden) wallets. The revert restores older behavior where, if the device is not asking for the passphrase on-device, the client acknowledges the passphrase request without providing an empty string. The practical effect depends on how the Trezor device firmware interprets the two acknowledgment types: one with an explicit empty passphrase and one without a passphrase field. It could affect which wallet derivation path or seed is used, potentially causing users to see a different wallet than expected, but the commit itself does not clearly introduce theft or remote exploitation.

This commit removes an unused Rust helper method that checked whether a passphrase should be entered on the Trezor device. It is a routine cleanup with no visible security effect.

This commit fixes an out-of-memory (OOM) crash during Ethereum payment-request signing on the Trezor Safe 3 (T2B1). The fix wraps UI layout construction in a temporary async task so the device's garbage collector can reclaim memory sooner. It is a reliability/DoS-style bug rather than a theft-of-funds vulnerability.

This commit is a code cleanup that changes how user-interface layouts are managed in the Trezor firmware. It wraps layout objects in explicit context managers (using `with ... as layout:`) and converts several synchronous-looking helper functions into proper async functions. There is no direct evidence in the commit that this fixes an exploitable security bug; it appears to be a defensive refactoring to enforce clearer scoping of UI resources.

This commit fixes a bug in the Trezor client library where users with a standard wallet (no passphrase) were still being prompted to enter a passphrase on their Trezor device. The fix ensures that for standard wallets, the client replies with an empty passphrase instead of incorrectly asking the device to handle it. This is a usability and workflow bug rather than a direct theft-of-funds vulnerability, but it could cause confusion or lead users to enter an unintended passphrase.

This commit fixes a timing weakness in how a Trezor hardware wallet checks the authenticity of a 'credential' used in its Trezor Host Protocol (THP). Previously, the device compared two secret codes with a standard equality check, which can leak information through tiny timing differences. The patch switches to a constant-time comparison function and adds a length check first. This is a defensive hardening change against side-channel attacks, but the commit message does not frame it as a security fix and no exploit is described.

This update fixes a bug in Trezor hardware wallets where the device would not properly lock itself when only SD card protection was enabled and no PIN was set. In that configuration, an attacker with brief physical access could potentially keep the device unlocked and use it without needing to enter a PIN or provide the SD card secret, bypassing the intended security protection.