Trezor firmware

This commit changes two bootloader linker scripts for Trezor hardware wallets, reducing the alignment padding between code/data sections from 512 bytes down to 4 bytes. The stated purpose is to remove unnecessary padding and save flash space. There is no indication in the commit or supplied references that this fixes a security vulnerability.

This commit adds a new developer-only command, `trezorctl set-log-filter`, that lets someone with physical debug access to a Trezor device change which internal log messages are printed. It only works when the device was built with a special debug-console feature enabled, and it does not change how ordinary user operations work. There is no direct evidence in the commit that this creates a security vulnerability, but any new debug command slightly increases the attack surface available to someone who already has debug access.

This is a minor code cleanup that changes how optional types are written in one Python file. It replaces the older `Optional[Type]` style with the newer `Type | None` style. There is no functional change and no security relevance.

This is a minor code cleanup in Trezor firmware's THP (Trezor Host Protocol) channel handling. It replaces a repeated check (`expected_ctrl_byte is None`) with a clearly named boolean variable (`return_after_ack`). There is no functional change and no security impact.

This commit adds a backup way for the Trezor device to check the version of the wireless nRF chip's firmware. If the normal app-to-app communication fails, the device can now ask the nRF chip's bootloader directly over a different channel. This is meant to make firmware update decisions more reliable, not to fix a known security bug. The change does not appear to introduce an obvious vulnerability, but it does add parsing of data received from the nRF chip and changes how the device decides whether to force an update.

This commit only changes an automated test file and its expected screen-output fingerprints. It makes a test less flaky by unlocking the simulated device through a normal wire request instead of a debug-only command after the event loop restarts. There is no change to the actual Trezor firmware or wallet behavior, so users are not affected.

This commit is a simple code cleanup: it extracts a repeated two-step operation (erase then write) into a single helper function and updates the only existing caller to use it. There is no change to what the code actually does, only to how it is organized. No security issue is introduced or fixed.

This commit is a code cleanup: it moves two repeated calls to a hardware security function into a new helper function. The actual operations performed on the device are unchanged. There is no indication this fixes or introduces a security bug.

This commit adds automatic retry logic for a secure chip (Tropic) inside some Trezor hardware wallets. When the chip reports it is in 'alarm mode' or certain communication errors occur, the device now resets the chip and retries the command up to five times. The change is framed as a reliability improvement, but it touches sensitive security operations like signing, PIN verification, and key storage. There is no direct evidence this fixes an exploitable vulnerability, but retrying destructive commands (like 'mac_and_destroy') could in theory have security side effects if not handled carefully.

This commit removes low-level clock-control code from the non-secure part of Trezor's STM32U5 firmware and replaces it with small, safe stubs. The stated reason is that the full clock-control peripheral (RCC) is not safely accessible when the kernel runs in non-secure mode, so using the vendor's standard routines there could cause problems. The change is defensive hardening rather than a clear, exploitable bug fix.

This is a tiny one-line fix in the user-interface code of the Trezor hardware wallet. It changes a placeholder value from 0 to 1 so that a UI scrollbar helper object is never created with 'zero pages,' which would trigger an internal sanity check (a debug assertion) and crash the device in debug/test builds. In release builds the assertion is normally removed, so the practical security impact is low. There is no direct evidence this is exploitable by an attacker.

This commit fixes a minor arithmetic bug in the star-shaped loading animation on Trezor hardware wallets. When the previous code calculated the position just before the currently selected star, it could subtract 1 from 0, causing an integer underflow. In Rust, this only triggers a panic when special debug checks are enabled, so normal user devices would not crash. The fix avoids the underflow by adding the total star count before subtracting one, then wrapping with modulo. It is a UI-only change with no direct security impact on funds or device secrets.

This commit fixes how the Trezor One (legacy) hardware wallet displays Ethereum and EVM token amounts on its small screen. Previously, the numeric value and the currency symbol (like 'ETH' or a token ticker) were combined into one long string. On the device's narrow display this could cause the symbol to be cut off or hidden, making it hard for the user to know which asset they are approving. The change splits the value and the unit onto separate lines so the symbol is always visible. This is a user-interface safety improvement rather than a cryptographic bug, but it can help prevent users from accidentally approving misleading transactions.

This commit fixes a data-generation template for Trezor's older (legacy) firmware so that Ethereum network entries use the proper currency symbol and network name fields instead of incorrectly copying the network shortcut into the symbol field and leaving the name blank. It appears to be a UI/labeling correctness fix rather than a vulnerability, but the change could affect what users see when confirming Ethereum transactions on the device.

This commit only adds a new test case for the Base cryptocurrency network. It does not change any production firmware code, so it cannot introduce a security vulnerability or fix one. It is purely a testing update.

This commit simply exposes the device's production date to the Python/MicroPython layer in Trezor firmware. It is a feature addition, not a security fix or vulnerability. The change reads an existing date from device-specific flash memory and makes it available through a new function. There is no indication this introduces a security issue.

This commit only changes how automated code checks and tests are run for Rust code. It adds a new CI job, creates a Makefile to run style checks, tests, and a linter across Rust crates, and adjusts gitignore files. There is no change to the actual Trezor firmware or wallet behavior, and no security bug is fixed or introduced.

This is a minor code-style cleanup in the Rust trezor-client library. It adds an empty placeholder feature flag named 'evolu' to the package manifest and removes an unused public re-export of the Solana module. There is no functional or security change visible in the diff.

This commit only reformats the source code by splitting long function signatures across multiple lines. No behavior, logic, or security properties of the JPEG decoder were changed.

This commit adds a brand-new Rust implementation of the Trezor Host Protocol (THP), a low-level transport layer that handles packet headers, fragmentation/reassembly, checksums, sequence/ack bits, and basic message types such as ping/pong, acknowledgments, and handshakes. It is a feature commit with no changelog entry and no accompanying security disclosure. The code is purely a new library plus tests/example; it does not patch any reported vulnerability.

This commit slightly enlarges two internal memory buffers used to hold extended public keys (XPUBs) in the Trezor legacy firmware. The change gives each buffer one extra byte, likely to ensure a null terminator can always fit after a maximum-length serialized key. It is a defensive hardening change rather than a fix for a confirmed exploitable bug, and the commit message calls it a refactor with no changelog.

This commit adds a new convenience feature to the older Trezor One (legacy) firmware: when you ask the device for a public key, it now also returns a BIP-380 output descriptor string. This is a standardized way to describe how that public key should be used in Bitcoin wallets. The change is a feature addition, not a fix for a known security bug. It does not change how private keys are handled or how transactions are signed.

This change simply moves a set of helper macros from one file to a new shared header file. The macros themselves are unchanged, and no program behavior is modified. It is a routine code cleanup (refactoring) with no security relevance.

This commit adds a new 'build version' number to the information a Trezor device reports about itself when asked. It is a feature addition that exposes more version detail to host software and users. There is no indication in the commit that it fixes a security bug or introduces a vulnerability.

This commit only updates internal documentation for the Trezor firmware project. It clarifies how user-interface 'ButtonRequest' events are generated from Python versus Rust code. No source code, build scripts, or security behavior was changed.