Trezor firmware

This commit fixes a logging bug in Trezor firmware's debug console output. Previously, the code used a width specifier to print a log source name, which could read past the end of a string that isn't null-terminated. The fix switches to a precision specifier that respects the known length. This is a defensive correctness fix in debug-only logging code; there is no direct evidence it is exploitable as a security vulnerability.

This commit simply updates the project's protobuf dependency from an old version (3.19) to a newer one (6.32) and pins the Python package version to match. There are no code changes, no bug fixes, and no security patches visible in the diff. It is a routine build/dependency maintenance change.

This commit only regenerates Rust source files from protobuf definitions using a newer version of the protoc compiler (31.1 instead of 3.19.6). The only visible changes are updated version comments and a few reordered bytes inside generated metadata. There is no change to message logic, security behavior, or how the Trezor device handles data.

This commit adds a GitHub Actions bot that automatically moves closed pull requests to the correct column on a project board. It is purely a workflow automation change for project management and has nothing to do with the Trezor firmware code, device security, or user funds.

This commit adds memory-protection reconfiguration around the NFC interrupt handler in Trezor hardware wallets. The change ensures the interrupt handler runs with default memory permissions, then restores the previous protection state afterward. It is a hardening fix rather than a clear-cut patch for an actively exploitable vulnerability, but missing MPU setup in an interrupt handler could theoretically allow memory-access bugs or privilege issues during NFC operations.

This commit renames an NFC driver to be chip-agnostic and reorders its startup steps so the interrupt line is configured before the NFC controller is initialized, then cleared again after. It also swaps a flag-clearing macro for a more correct interrupt-clearing macro. These are defensive housekeeping changes that reduce the chance of a stale interrupt firing at the wrong moment during startup. There is no direct evidence this fixes an exploitable security bug.

This commit fixes a small coding issue in Trezor's factory production-test tool for NFC hardware. Previously, two NFC setup functions were called without checking whether they succeeded. Now the code checks their return values and reports a fatal error if they fail, then jumps to cleanup. This is a defensive quality improvement in a diagnostic/testing utility, not a fix for an exploitable security vulnerability in the wallet firmware itself.

This commit is a large code reorganization of the NFC (Near Field Communication) driver inside Trezor firmware. It moves the ST25R3916 RFAL library from one directory to another and updates build paths and board configuration files accordingly. There is no indication in the commit message or diff that this fixes a security vulnerability; it is described as a refactoring to make it easier to support different STMicroelectronics chips in the future. The change is mostly a directory rename plus path updates, with no functional security fix visible in the diff.

This commit is a routine user-interface feature change for Trezor hardware wallets. It lets the new 'Eckhart' screen layout optionally show an information screen with a disabled button (for example, a grayed-out 'Continue' that becomes active only after a timer or condition). Older layouts keep their previous behavior. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a product/usability feature.

This commit is a routine user-interface feature addition for the Trezor hardware wallet firmware. It adds an optional 'external menu' flag to the 'show_info' screen layout, primarily for a new device design (Eckhart/N4W1). On older layouts, the flag is rejected with a 'not implemented' error. There is no security-relevant change visible in the code.

This commit is a small code cleanup in the Trezor hardware wallet firmware. It changes how on-screen keyboards are managed during wallet recovery (when users type in their backup seed words). Previously, the code explicitly called a destructor-like method `keyboard.__del__()` inside a try/finally block to ensure cleanup. Now it uses Python's `with keyboard:` context manager, which is a more standard and safer way to guarantee cleanup happens. There is no direct evidence this fixes a security vulnerability.

This update fixes a memory issue in Trezor hardware wallets that could crash the device (out-of-memory) when confirming very large pieces of on-screen data. The fix ensures a temporary screen-layout object is explicitly released after use, rather than lingering in memory. It is a reliability/availability fix rather than a direct theft-of-funds vulnerability.

This commit is a code cleanup: it replaces explicit calls to a destructor-like method with Python's standard 'with' context-manager pattern for homescreen objects. It does not add or remove security behavior; it only makes the cleanup more reliable and idiomatic. There is no indication this fixes an exploitable vulnerability.

This commit adds a new hardware feature for the Trezor T3W1 device that lets the user wake the device from suspend mode by touching the screen. It changes how the display and touch drivers are turned off and back on, and adds a new wake-up flag for touch events. The feature is currently disabled by default in the build configuration (TOUCH_WAKEUP_ENABLED is set to 0). There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a normal feature addition.

This commit is a straightforward code cleanup. It removes a header file include in a C file and replaces it with a direct declaration of a Rust-implemented function, while removing that same declaration from a shared header. The change breaks a circular dependency between the low-level graphics code and the Rust UI layer. There is no functional change to how errors are displayed, no bug fix, and no security-relevant behavior change.

This commit fixes the TrustZone security configuration on the STM32U5 chip used in Trezor hardware wallets. TrustZone splits the processor into a secure world (for secrets like the seed and PIN) and a non-secure world (for the main user interface). The patch makes three changes: it temporarily disables the Security Attribution Unit (SAU) while reprogramming it, adds memory barriers so the new rules take effect correctly, and marks one DMA channel's interrupt as secure. Without these fixes, secure memory regions could potentially be reachable from non-secure code, or security settings might not be applied reliably during boot.

This commit only changes how the software development library SDL is included in source files for the Unix emulator build. It replaces generic include paths like <SDL.h> with versioned paths like <SDL2/SDL.h> and moves some includes outside a conditional block. There is no security-relevant change to the actual code logic, and no indication this fixes a vulnerability.

This is a routine cleanup commit in Trezor's embedded firmware. It mostly adds or tightens conditional compilation guards (so certain security-related code only compiles in secure/kernel builds), removes unused header includes, fixes a minor function declaration, and replaces a traditional header include guard with a simpler pragma. There is no direct evidence of an exploitable vulnerability being patched, and the commit message explicitly calls these 'minor fixes' with no changelog entry.

This commit adjusts how the production-test firmware for three Trezor hardware models calculates the length of the code image stored in flash memory. The old calculation added up the sizes of individual sections, which could become inaccurate if the linker layout changed. The new calculation uses a single marker placed at the actual end of the code/data in flash. This is a hardening improvement rather than a fix for an active attack, but an incorrect code-length value could theoretically cause a mis-sized firmware image to be written or verified during manufacturing tests.

This commit fixes a small but real bug in the Trezor emulator (the desktop/Unix version used for testing, not the real hardware wallet). When the emulator tries to shut down a MicroPython task, it previously ignored whether the internal 'push call' operation succeeded. If that operation failed, the code would still try to switch to the task, potentially leaving the emulator in an inconsistent or hung state. The fix adds an explicit error shutdown if the push fails. It is a hardening fix rather than a clear exploitable vulnerability, and it only affects the Unix emulator build.

This is a code cleanup change in Trezor's embedded firmware. It moves display de-initialization logic into a new compatibility helper file and renames a clock-setting function to make the code clearer. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a refactoring to remove a circular dependency between system startup code and the display driver.

This commit fixes a build or runtime problem in the Trezor hardware wallet's production-test firmware when it is compiled for the software emulator. It wraps real hardware calls (deinitializing the Bluetooth module and UART, resetting the NRF chip, and entering direct test mode) inside a check that skips them on the emulator. There is no direct user security impact; it is a build/test-harness fix.

This commit only adds Rust compiler directives to silence warnings about unused macros and imports. It does not change any program behavior, fix a bug, or address a security issue.

This commit simply adds a new build output folder named 'build-xtask' to the .gitignore file in the Trezor firmware repository. A .gitignore file tells Git which files and folders to ignore and not track in version control. This change has no effect on the actual firmware code, device behavior, or security of the product. It is a routine housekeeping change for developers.

This commit fixes a type mismatch in the Trezor firmware emulator's bootloader code. The FIRMWARE_START symbol was declared as a pointer to bytes (uint8_t*) but was being assigned a raw memory address value. On 64-bit emulator builds this could lead to incorrect memory handling or crashes because the sizes and interpretations of the two types differ. The fix changes the symbol to a plain integer address type (uintptr_t), which is the correct way to store raw memory addresses in portable C code. This change only affects the emulator (software simulation), not real Trezor hardware.