Trezor firmware

This commit changes a low-level firmware file that handles system calls on Trezor hardware wallets. It disables the compiler's stack protector (a safety feature that helps detect certain memory corruption bugs) specifically in the 'syscall stubs' code. The commit message frames this as a feature and does not explain why the protector is being disabled or claim any security benefit. On its own, disabling a security mitigation is a security signal, but the diff is too small to determine whether this introduces a real vulnerability or is a necessary workaround for a technical constraint.

This commit fixes two low-level operating-system bugs in Trezor's embedded firmware. First, it corrects how the kernel waits for hardware events (button presses, USB packets, etc.) when more than one mini-program ('applet') is running. Previously, the kernel stored direct pointers to each waiting task's event masks, which could create race conditions or incorrect results when multiple tasks polled at the same time; now it keeps private copies and only writes the result back when the task actually wakes up. Second, it fixes a bookkeeping bug where new system task IDs were never marked as used, which could eventually hand out the same ID twice. It also makes sure the memory-protection unit (MPU) is switched to the correct applet before a task starts running or is woken up. The commit is tagged '[no changelog]' and gives no security context, so while the bugs are real, there is no direct evidence they are exploitable for theft of funds or secrets.

This commit reworks how the Trezor Core firmware configures the memory protection unit (MPU) when switching to small helper programs called applets. It adds a dedicated thread-local storage (TLS) region for applets and fixes a bug where region 4 was being configured from the wrong layout field (code2 vs data2). The changes are framed by the developer as an improvement, not a security fix, and no external security references are provided.

This commit adds a new 'thread-local storage' (TLS) memory section for Trezor's coreapp on newer hardware models. It changes how the device saves and restores small, per-task memory areas when switching between tasks. The change is a feature implementation, not a fix for a known security bug. There is no evidence in the commit or supplied references that this addresses an active vulnerability or was disclosed as security-relevant.

This commit is a small internal cleanup of how the Trezor firmware's kernel talks to applets (isolated mini-programs). It removes a direct pointer to the applet's header from the applet structure and instead reads that header from the start of the applet's code area when needed. The change is described as a refactor with no changelog. There is no direct evidence in the commit that this fixes a security vulnerability, but it does reduce the chance that a stale or manipulated header pointer could be used.

This commit is a code cleanup that moves coreapp-specific logic out of the generic applet code into a new dedicated coreapp module. It does not appear to fix or introduce a security vulnerability; it is a structural refactor to make the applet abstraction more generic and prepare for future extension applets.

This commit marks several fixed data objects as read-only constants so the compiler can place them in flash memory (.rodata) instead of writable RAM. This is a hardening change: it prevents accidental or malicious code from modifying values like the device model name, USB product strings, firmware revision, and the base32 alphabet. There is no direct evidence in the commit that an actual exploit exists; it is a defensive memory-layout fix.

This is a one-line fix in an automated GitHub workflow that pulls translations from Crowdin. The change adds 'uv run' before the 'make' command so the build environment finds the correct Python tooling. There is no indication this affects device firmware, user funds, secrets, or security.

This is a routine fix to a GitHub Actions workflow that pushes translation source files to Crowdin. It renames the job, adjusts how the environment is set up, and corrects the secret name used for the Crowdin API token. There is no security-relevant change.

This commit adds a manually-triggered GitHub Actions workflow that downloads translated text files from the Crowdin service, merges them into the project's language files, and opens a pull request. It does not change any firmware code, wallet logic, or cryptographic handling. There is no indication this introduces a security vulnerability.

This commit adds support for retrieving Tron cryptocurrency addresses on Trezor hardware wallets. It is a feature addition that extends existing address-derivation infrastructure to a new blockchain. There is no indication in the commit that it fixes a security bug or introduces a vulnerability.

This commit updates the Tron coin support in Trezor firmware to use the newer 'session' API and changes the Tron message type numbers. It also removes unused Tron transaction-signing message definitions and limits Tron support to debug builds only. There is no direct evidence in the commit of a security vulnerability being fixed; it appears to be a maintenance and integration cleanup change.

This commit is a routine cleanup of on-screen text for the Trezor hardware wallet. It removes English text strings that are only used by the older 'Bolt' user-interface layout, leaving those strings empty for newer layouts (Caesar, Delizia, Eckhart) where they are not displayed. There is no change to security logic, cryptography, or how the device protects funds.

This commit fixes how the Trezor hardware wallet schedules its automatic deep-sleep (hibernate) timer on STM32U5 devices. It replaces a simpler one-shot RTC timer with a new RTC scheduler that tracks event IDs, and it now properly cancels pending hibernate events when the device wakes up. The change appears to be a bug-fix for power management reliability rather than a security patch, but a mis-scheduled hibernate event could theoretically affect device availability or battery life.

This commit refactors how the Trezor hardware wallet talks to its built-in Infineon OPTIGA security chip. It splits the old 'init/deinit' routines into smaller steps (power up/down, open/close channel) and adds new suspend/resume logic. The goal appears to be reducing wear on the OPTIGA chip by avoiding full power cycles when the chip's internal security-event counter (SEC) is high. There is no direct evidence in the commit that this fixes a known exploitable vulnerability, but it changes sensitive secure-element lifecycle code and introduces new secure-monitor call interfaces that could affect device security if misused.

This commit changes how the Trezor hardware wallet's low-power suspend/resume routine handles the Optiga security chip. Previously, the device fully shut down and later re-initialized Optiga during suspend and resume. Now it keeps Optiga powered and uses new suspend/resume helpers, with the suspend step moved out of secure mode so it can access the real-time-clock scheduler while waiting for an internal security counter to clear. The change is framed as a feature/refactor, but it touches security-critical hardware state and could affect secure-key availability or side-channel behavior if the new helpers are not equivalent to the old init/deinit cycle.

This commit is a straightforward build fix that changes which internal header files three source files include when the Optiga security chip support is enabled. It replaces references to configuration and transport headers with a single initialization header. There is no indication in the commit that this fixes a security vulnerability or changes runtime behavior in a security-relevant way.

This commit refactors the real-time clock (RTC) wakeup system in Trezor's embedded firmware so that multiple timed wakeup events can be queued and scheduled instead of only one at a time. It is a feature addition ("Introduce rtc event scheduler") with no changelog entry. The change is mostly architectural: it moves single-wakeup logic into a small scheduler and changes the timer API from a relative number of seconds to an absolute RTC timestamp. There is no direct evidence in the commit that this fixes a security vulnerability, and the vendor does not describe it as security-relevant.

This commit fixes the Trezor emulator build on macOS. It replaces Linux-only socket flags (SOCK_NONBLOCK and MSG_DONTWAIT) with portable equivalents that work on both Linux and macOS. The socket is still set to non-blocking mode using fcntl, and the send/receive calls now rely on that non-blocking state instead of per-call flags. There is no security-relevant change.

This commit adds a small optimization to the Tropic secure-element integration in Trezor firmware: if a secure session is already active for the same pairing key, the code now skips re-establishing it. The change is defensive in nature and appears aimed at avoiding redundant session setup, not at fixing a known vulnerability. There is no direct evidence in the commit that this resolves an exploitable security flaw.

This commit fixes a production-test command used inside Trezor's factory tooling. The command for reading a FIDO security key was failing because it tried to read the key without first starting a secure session with the Tropic chip. The patch adds the missing session-start step before reading the key. It is a bug fix in internal manufacturing diagnostics, not a user-facing wallet security flaw.

This commit only removes an old TODO comment from a production-test source file. No code behavior changes, no bug fix, and no security relevance is present in the diff or commit message.

This commit refactors how the Trezor firmware's production-test code establishes secure sessions with the Tropic secure chip. It replaces scattered, manually-managed key-loading and session-start code with a single internal helper, `tropic_custom_session_start()`, and adds a way to invalidate an existing session before starting a new handshake. The change is described by the vendor as a refactor and improvement, not as a security fix. The diff does not show an obvious exploitable vulnerability, but it does remove several direct `memzero()` calls that cleared private key buffers in production-test routines; that cleanup is now handled inside the new helper. Because the commit touches sensitive pairing-key handling and session state, it has defensive-security relevance, but there is no disclosed incident or CVE.

This commit changes a function parameter declaration from an empty array syntax to a pointer syntax in the Noise protocol cryptography code. It is purely a coding-style/compiler-warning fix with no functional change to the program's behavior or security.

This commit is a code cleanup: it moves the Tropic chip certificate cache out of the production-test command file and into the shared Tropic driver, then exposes two helper functions so other code can fetch the cached public key and certificate chain. There is no visible security bug being fixed or introduced in the diff itself.