Trezor firmware

This commit only changes test helper code in the Trezor Python client library. It refactors how automated tests navigate on-device menus for newer Trezor hardware models (Eckhart and Delizia). There is no change to firmware runtime, wallet logic, cryptography, or any user-facing security behavior. It is a testing infrastructure improvement with no security relevance.

This commit is a test-only helper update. It extends an automated UI traversal routine in the Python test library so it can also exercise the newer 'flow menu' screens on Trezor hardware. There is no change to device firmware, cryptography, user-facing behavior, or production code.

This commit is a small defensive cleanup in Trezor's user-interface code. It adds a runtime check that prevents two UI features—'info' and 'external_menu'—from being used at the same time, because that combination is not implemented. It also removes two places in Python code that accidentally passed both flags together. The change makes a previously silent debug-only assertion into an explicit error, which helps avoid unexpected UI behavior rather than fixing an active security vulnerability.

This is a small internal code cleanup for the user interface of a new Trezor device layout (codenamed 'Eckhart'). It adds a marker flag called is_cancel to buttons that represent a 'Cancel' action, so automated testing/debug tools can identify them more easily. The visible behavior of the device does not change.

This commit is a code cleanup in the user-interface code for the Trezor hardware wallet's 'delizia' layout. It adds a way to mark on-screen cancel buttons as 'cancel' buttons, primarily so automated testing/debug tools can identify them. It does not change what the buttons do or introduce any security-relevant behavior.

This commit is a test-only/internal UI change for the Trezor firmware. It adds a flag called has_flow_menu to a screen component and marks three screens in the confirm_output flow with that flag. The flag is only used to expose menu state to automated tests/debuglink, and does not change user-facing behavior or fix any security issue.

This commit removes several internal 'debug' flags from normal production builds of the Trezor firmware and keeps them only in builds that have the optional 'ui_debug' feature enabled. These flags are used by automated tests (debuglink) to navigate menus and identify cancel buttons; they do not directly control security checks. The change reduces the chance that test-only state could accidentally affect or leak information in production firmware, but it is a cleanup rather than a fix for an active vulnerability.

This is a routine build tooling update. The commit replaces one Nordic programming tool (nrfjprog) with its newer replacement (nrfutil) in a CMake board configuration file. It does not change any firmware code that runs on the Trezor device or affect how the device operates.

This commit adjusts linker scripts that control how the Trezor hardware wallet's bootloader and security monitor (secmon) binary images are laid out in flash memory. It reduces alignment padding from 512 bytes to 4 bytes and changes how unused space at the end of each image is filled with zeros. The change appears to be a correctness fix for image padding rather than a fix for an exploitable memory corruption bug, but the exact security implications are not stated by the vendor.

This commit changes how many wrong PIN attempts are allowed on Trezor hardware wallets that use a component called Tropic. Previously, devices using both Tropic and Optiga security chips were limited to 10 PIN attempts, while devices using only Tropic were allowed 16. The change makes all Tropic-based devices use 10 attempts, matching the stricter limit. This is a defensive consistency fix, not an active vulnerability patch, but it reduces the attack surface for PIN brute-force attempts on Tropic-only devices.

This commit simply deletes an old internal helper script that was used to update minimum firmware version numbers in the Python library. The script fetched public release data from Trezor's servers and rewrote a source file. Removing it does not change any runtime code, device firmware, or installed library behavior, and there is no indication it fixed or introduced a security problem.

This commit adds Rust wrappers around existing low-level cryptographic functions in the Trezor firmware so they can be used by a new feature called THP. It does not appear to fix a known bug or vulnerability. The changes are mostly a refactor: they expose AES-GCM, Curve25519, HMAC-SHA256, SHA-512, CRC32, and a random-byte helper to Rust code, and add unit tests. There is no direct evidence in the commit that this resolves a security issue, but any new crypto binding introduces a small chance of misuse or memory-safety mistakes.

This commit simply bumps the version of a Rust dependency called zeroize from 1.7.0 to 1.8.2. zeroize is a library used to securely erase sensitive data from memory. The change itself is a routine version update with no visible security fix or vulnerability being addressed in the commit. There is no indication this update fixes a known security problem in Trezor firmware.

This commit is a code cleanup: it removes duplicate helper macros from several cryptography modules and replaces them with a single shared macro. There is no change to user-facing behavior, no bug fix, and no security patch. It is purely an internal refactoring to make the code easier to maintain.

This commit fixes a compiler-specific alignment definition for AES cryptographic data structures. Previously, the code only forced memory alignment when compiled with GCC on 64-bit x86, but not when compiled with Clang on the same architecture. The change makes Clang behave the same way as GCC, ensuring the AES context has the same memory layout regardless of which compiler is used. This is a hardening/fix for consistency in cryptographic code, but the commit message does not describe an active exploit or security vulnerability.

This is a routine dependency update for the Rust build tool bindgen inside Trezor firmware. It bumps bindgen from version 0.62.0 to 0.72.1 and adjusts the code to match the newer API. The change removes a small workaround that forced a function signature to be read as non-const pointers, because the newer bindgen now generates the correct const pointers. There is no direct security fix here, but keeping build tools current reduces the chance of future bugs or build issues.

This is a one-line change adding a missing C standard header file (`stdbool.h`) to a cryptographic header. It enables the use of `bool`, `true`, and `false` types in the file. There is no functional code change, no bug fix, and no security-relevant behavior change visible in the diff.

This commit fixes a bug in the Trezor hardware wallet's THP (Trezor Host Protocol) communication code. Previously, if the final acknowledgment (ACK) from the computer/app was lost, the device would not properly advance its internal sequence bit. This could cause the next message to use the wrong sequence number, potentially confusing the host software (Trezor Suite) and disrupting communication. The fix ensures the sequence bit is always advanced after a write attempt, even if the ACK is lost or the write is blocked.

This commit removes the ability to download or install 'beta' firmware versions through the Trezor Python command-line tool. It is a feature cleanup, not a security fix. There is no indication it patches a vulnerability.

This commit only changes a test command in the build Makefile. It wraps an emulator sanity check with a 10-second timeout so automated tests don't hang indefinitely if the emulator fails to start. There is no change to firmware code, cryptography, device behavior, or anything users interact with.

This is a test-only change that adds a device wake-up step for one specific Trezor model (T3W1) in an automated test. It does not modify the firmware or any production code, so it has no direct security impact on users.

This commit changes an automated GitHub workflow so that translation-sync pull requests are created using a dedicated bot account's token instead of the repository's default GitHub token. It also adds one employee as the assignee and reviewer. The change is a CI hardening/fix, not a vulnerability in the Trezor firmware itself. There is no direct evidence in the commit that this fixes an active security issue, but using a scoped bot token is generally safer than the default token because it limits what the workflow can do.

This commit changes a low-level firmware file that handles system calls on Trezor hardware wallets. It disables the compiler's stack protector (a safety feature that helps detect certain memory corruption bugs) specifically in the 'syscall stubs' code. The commit message frames this as a feature and does not explain why the protector is being disabled or claim any security benefit. On its own, disabling a security mitigation is a security signal, but the diff is too small to determine whether this introduces a real vulnerability or is a necessary workaround for a technical constraint.

This commit reworks how the Trezor Core firmware configures the memory protection unit (MPU) when switching to small helper programs called applets. It adds a dedicated thread-local storage (TLS) region for applets and fixes a bug where region 4 was being configured from the wrong layout field (code2 vs data2). The changes are framed by the developer as an improvement, not a security fix, and no external security references are provided.

This commit adds plumbing for a new hardware feature called RWPI (Read-Write Position Independent code) in small helper programs ('applets') running on Trezor devices. It stores a 'static base' address in each task and sets register r9 when starting an applet. The change itself is a feature addition, not a visible bug fix, and there is no direct evidence in the commit that it fixes a security vulnerability. It may be defensive groundwork for safer dynamic app loading, but that is speculative.