Trezor firmware

This patch fixes a kernel crash that could occur when an external (untrusted) application running on the Trezor device faults. The crash happened because the kernel tried to read a return address from a memory region it was not allowed to access. The fix temporarily relaxes memory protection just long enough to safely read that address, then restores it. It is a stability/reliability fix in a security-sensitive component, but the commit itself does not claim it is exploitable for theft of funds or secrets.

This commit introduces a new application loader and cache subsystem for the Trezor firmware. It adds code that loads external ELF-format applications into memory, manages their execution as isolated applets, and handles memory allocation for them. The change is a feature addition, not a documented security fix. The code includes a prominent warning that the STM32 ELF loader implementation should not be shipped in production devices. There is no evidence in the commit or supplied references that this resolves a known security incident or vulnerability.

This commit adds a new MicroPython module called `trezorapp` that lets Python code create, write, finalize, and run third-party application images inside the Trezor firmware. It is a feature implementation rather than a bug fix, and there is no direct evidence in the commit that it fixes a security vulnerability. However, because it exposes low-level app loading and task control to Python, any weaknesses in the underlying `app_cache`/`app_loader` C code or in how Python callers use this wrapper could become security-relevant. The commit itself does not describe security relevance, credit a researcher, or acknowledge a vulnerability report.

This commit adds a brand-new inter-process communication (IPC) subsystem to the Trezor firmware kernel. It lets separate software tasks send fixed-size messages to each other through kernel-managed queues, with memory copies that temporarily disable the memory-protection unit on STM32 hardware. There is no claim in the commit that this fixes a security bug; it appears to be a new feature. The code includes access checks (verifiers) for the user-space syscall path, but because this is a new and complex kernel mechanism, any mistakes in the queue logic or memory copying could become security issues in the future.

This commit adds a new internal API surface called 'coreapp API' that lets the core firmware expose a small set of system services (timers, events, debug console, IPC, and shutdown helpers) to a separate 'coreapp' component. It is only enabled for the T3W1 model and is guarded by an 'app_loading' build feature. The change is architectural: it wires a function-pointer getter into the vector table and stores it in the coreapp header so the coreapp can request versioned API tables. There is no direct evidence in the commit of a vulnerability, exploit, or security fix; it appears to be a feature introduction for future app-loading support.

This commit adds a new build-time switch called EXTAPP_SUPPORT. When turned off (the default), it prevents the 'app_loading' feature from being compiled into firmware for the T3W1 model. This is purely a build-system/configuration change and does not alter runtime behavior, fix a bug, or change any security-critical code path on its own.

This commit changes a single internal constant so the device can keep track of one extra background process when the optional app-loading feature is enabled. By itself it does not look like a security fix or vulnerability; it appears to be a straightforward capacity increase for a new feature.

This is a minor test-only cleanup. It removes a hardcoded path tweak inside the test helper file and sets the same search path through an environment variable in the test runner script instead. There is no change to the actual Trezor firmware or wallet security.

This update fixes a bug in Trezor hardware wallets when signing certain Ethereum token-approval transactions. Some legitimate DeFi transactions include extra data that the wallet did not expect, which previously caused the device to crash instead of signing. The fix makes the wallet fall back to a simpler, generic signing mode for these unusual transactions. It is a reliability/usability fix rather than a theft-of-funds vulnerability, but a crash could still be used to deny service or trick a user into a less safe workflow.

This commit simply removes an unused third-party Python library called cbor2 from the project's dependency list. There is no indication of a security vulnerability, no code changes, and no fix applied. It appears to be routine dependency cleanup.

This update changes how Trezor handles one specific Solana instruction (SetComputeUnitLimit) so it can optionally accept a reference to another program account. Previously the device rejected or could not parse transactions that included this extra account reference, which is used by some services such as Jito. The change is a compatibility fix rather than a clear-cut security patch, but the prior strict parsing could have caused transaction failures or user confusion when signing legitimate Solana transactions.

This is a cosmetic code cleanup. It removes an unnecessary empty keyword-only argument marker from a function signature in documentation and a mock file. There is no functional change to the code that runs on the device.

This is a routine dependency update generated by Dependabot. It bumps the Rust crate `tracing-subscriber` from version 0.3.19 to 0.3.20 in a Cargo.lock file. The change only affects lockfile entries and transitive dependencies used for logging output formatting. There is no indication of a security fix or vulnerability being addressed.

This commit is a straightforward memory-optimization refactor. It replaces a large lookup table of individual English strings with a more compact packed representation, reducing firmware size by about 8 kB. There is no user-facing behavior change and no security fix or vulnerability introduced.

This commit is a build-system fix for the Trezor firmware. It changes how the Rust static library is added to the linker command in SCons scripts and corrects the relative path to the compiled Rust library. There is no indication in the commit that this fixes a security vulnerability; it appears to be a build correctness or path-fix change.

This commit is a test-infrastructure change only. It adds a way for automated tests to read the account name shown on a FIDO security-key confirmation screen, and renames some existing test helper methods from 'tt_' to 'bolt_' to better match the current product naming. There is no change to how user data is handled, no fix for a bug, and no security-related behavior change.

This commit only updates a reference to an external test suite (fido2-tests) used by the project. There is no code change visible, no security fix, and no indication of a vulnerability. It appears to be a routine maintenance task.

This commit changes a test helper function in Trezor's Python library so that it returns the text of the menu item it selected, instead of returning nothing. It is purely a testing/debugging improvement and does not change any device firmware or user-facing security behavior.

This is a simple code cleanup change that renames a parameter from 'auto_update' to 'show_menu' across several files. The functionality remains exactly the same; only the variable name has been changed to better describe what it actually controls (whether a menu button is shown on the bootloader connection screen). There is no security impact.

This commit is a visual layout fix for the Trezor T3W1 hardware wallet bootloader. It adjusts where the 'waiting for host' text appears on screen when no menu header is shown. There is no security-relevant change.

This commit is a pure code reorganization: it moves the unit_properties module from the util directory to the sec (security) directory and updates all include paths and build files accordingly. The actual logic for reading device properties from one-time-programmable memory, serial numbers, and SD hotswap settings is copied unchanged. There is no functional change and no security fix or vulnerability introduced.

This commit is a pure code reorganization (refactor) that moves the 'Red Screen of Death' (RSOD) error-display code from one directory to another and updates the build files and #include paths accordingly. No security vulnerability is introduced or fixed; the visible behavior of the device is unchanged.

This commit is a pure code reorganization: it moves the tamper-detection driver files from one directory (sys) to another (sec) and updates all include paths accordingly. The actual tamper-detection logic is unchanged, so this does not fix or introduce a security vulnerability on its own.

This commit is a large code refactor that moves the power management subsystem from one internal directory (`sys`) to another (`io`) in the Trezor firmware. It renames include paths, reorganizes files, and adds new battery fuel-gauge and PMIC driver code, but the commit message explicitly labels it as a refactor with '[no changelog]'. There is no indication of a security fix or vulnerability being addressed.

This commit is a large but straightforward code reorganization: it moves the firmware image handling module from a general utility directory (embed/util/image) into a security-focused directory (embed/sec/image) and updates all include paths and build scripts accordingly. The actual code logic appears unchanged except for the path/namespace adjustments. There is no indication this fixes or introduces a security vulnerability.