Trezor firmware

This change updates how Trezor devices decide whether downloaded Ethereum token/chain definition files are too old to trust. Previously there was one global cutoff date; now each definition format version has its own cutoff. This is a maintenance and correctness improvement, not a fix for an active security bug. It reduces the chance that a future format version could accidentally accept stale or incompatible definition data.

This commit updates the Trezor One (legacy firmware) to use version 2 of the external Ethereum token/network definition format. The key change is that legacy firmware now requires only one valid signature instead of two, and explicitly rejects the older version 1 format. This is a feature update to align legacy devices with the newer definition format, not a fix for an active security bug. The change is documented and includes tests verifying that version 1 definitions are rejected on legacy firmware.

This commit is a code cleanup that moves a small piece of boot-header parsing code out of an STM32-specific folder so it can also be used in emulator and test builds. It changes function arguments from raw flash addresses (uint32_t numbers) to generic pointers, and fixes one accidental use of a security-boolean value where a null pointer was intended. The commit message and diff show no intended behavior change on real devices.

This is a build-system-only change that moves where the NFC feature flag is defined so the emulator compiles correctly. It does not change any runtime behavior, user-facing functionality, or security logic.

This commit fixes a grammar typo in two code comments/docstrings, changing 'Receive a BLE events' to 'Receive a BLE event'. It does not change any executable code, behavior, or security properties.

This commit only changes how a command-line tool prints information about secure-monitor firmware headers. In non-verbose mode it now shows the device model and version instead of dumping every header field. There is no change to security checks, cryptography, or firmware behavior.

This commit adds a runtime check (assert) that ensures a UI function for confirming on-screen properties is never called with an empty list. It also changes the expected input type from a generic iterable to a sequence and converts a couple of generator expressions into lists. The commit message explicitly says it will not affect production builds, because assertions are typically stripped from production firmware. There is no direct evidence this fixes an active security bug; it appears to be a defensive hardening measure for development/debug builds.

This commit fixes a build-time tooling bug in Trezor's firmware build helper. When creating a combined firmware image, the tool was filling unused gaps between sections with 0x00 bytes. One specific gap (the UCB region) is erased by the bootloader on first boot. Because erased flash reads as 0xFF, the device would no longer match the original image after its first boot, causing factory verification to fail. The fix makes the tool fill that gap with 0xFF instead, so the image stays identical after the device boots. This is a manufacturing/verification bug, not a security vulnerability that can be exploited by an attacker.

This commit turns off an internal performance cache for BIP39, the system that converts a recovery seed phrase into cryptographic keys on Trezor hardware wallets. Disabling a cache is usually a defensive change: it can prevent sensitive seed-derived data from lingering in device memory longer than necessary. However, the commit gives no explanation, changelog entry, or linked security report, so we cannot tell whether this fixes a known vulnerability or is just a precautionary hardening measure.

This is a minor bug fix in the Trezor bootloader. When wiping the device, if a step failed, the bootloader always reported the same generic error message ('Could not read BLE status') even when the actual failure was something else, such as failing to erase stored data or issue a Bluetooth command. The fix makes the bootloader report the correct, specific error message. It does not change whether errors happen or how they are handled; it only corrects the message sent to the host computer.

This is a small internal code cleanup in the Trezor firmware's Rust UI layer. It moves some MicroPython-specific code into its own submodule and removes an unused import. There is no visible change to user-facing behavior or security-sensitive logic.

This commit is a minor code cleanup in a test file. It reorganizes Python import statements to follow style guidelines by importing Callable and Sequence from collections.abc instead of typing. There is no functional change and no security relevance.

This commit only adds a new test case for the Benqi sAVAX redeem function. It includes test data, a small external definition file, and expected screen hashes for automated UI tests. There is no change to production firmware code, no bug fix, and no security patch.

This commit is a minor user-interface fix for Ethereum 'clear signing' flows on Trezor hardware wallets. It simply skips showing a contract-details screen when there are no details to display. There is no indication this is a security fix, and the change does not alter what users must approve before signing a transaction.

This commit removes an unused import of a string type from a Rust source file. It is a routine code cleanup with no functional change and no security relevance.

This commit is a minor user-interface improvement for a developer/debugging tool. It adds a 'verbose' mode to the text output shown when inspecting a Trezor firmware file header. In non-verbose mode it now prints a shorter summary (device model, version, fingerprint, signature/hash status) instead of dumping every header field. There is no change to security checks, cryptography, firmware loading, or device behavior.