Trezor firmware

This commit removes a dedicated two-page 'confirm output with amount' screen and replaces it with two separate confirmation prompts for the address and the amount. It is a user-interface refactor, not a fix for a security vulnerability. The change does not introduce obvious security flaws, but it slightly alters how users review transaction details on newer Trezor layouts.

This commit is a routine user-interface feature addition. It lets certain 'property' display screens show an optional subtitle and gives callers a way to override the page title. There is no security-relevant change in the diff.

This commit is a routine code cleanup: it pulls a repeated user-interface loop into a shared helper function called confirm_linear_flow. There is no change to security behavior, no bug fix, and no indication of a vulnerability.

This commit adds a new on-screen prompt that asks users to confirm they really want to cancel a transaction-signing flow. It is a user-experience and safety feature, not a security fix. There is no evidence of a vulnerability being patched.

This commit only updates expected test result hashes (called 'fixtures') in a single JSON file used by the Trezor firmware UI test suite. There are no code changes, no firmware changes, and no user-facing behavior changes. It is a routine maintenance update to keep automated tests passing after unrelated visual or internal changes elsewhere in the project.

This commit is a straightforward internal code cleanup. It introduces a new type alias called StrPropertyType for UI properties that are always text strings (never raw bytes), and replaces some str(x) conversions with x or "" to handle possible None values more cleanly. There is no indication this fixes a security bug or changes user-visible behavior.

This commit adds a new optional 'back button' to a Trezor screen type called confirm_value. It is a user-interface feature for the upcoming Eckhart hardware model and does not fix or introduce any security vulnerability. The change simply lets callers request a back arrow instead of a cancel cross, and wires that through the Rust UI layer for all supported device layouts.

This commit adds a 'swipe down to go back' feature to the Delizia user interface on Trezor hardware wallets. When reviewing a cryptocurrency transaction, a user can now swipe down on the amount screen to return to the address screen and double-check it. It is a usability improvement, not a fix for a vulnerability.

This commit is a straightforward internal code cleanup in the Trezor firmware's user-interface layer. It replaces several individual settings inside a 'ConfirmValue' screen builder with a shared 'ConfirmActionOptions' object. There is no change to user-visible behavior or to security logic; it is purely a refactor to reduce duplicated code.

This commit is a straightforward code cleanup: it bundles several settings for confirmation screens into a single ConfirmActionOptions struct instead of passing them as separate function arguments. There is no change to user-facing behavior, no bug fix, and no security-related change.

This commit changes how the Trezor firmware's vibration motor (haptic) driver reports and handles errors. Previously, some haptic functions returned simple true/false success values, and some callers ignored the result of initialization. Now those functions return a structured status code, callers capture the status (though mostly still ignore it), and one resume path actually halts on failure. A test-only haptic syscall was removed. The changes are defensive cleanups rather than a fix for a known exploitable bug, but they reduce the chance that a failing haptic device could leave the system in an inconsistent state.

This is a small fix to the Trezor hardware wallet's production-line testing tool for the vibration motor (haptic feedback). It renames a variable, updates the driver initialization and playback calls to use newer error-handling types, and switches from a fixed vibration pattern to a custom 100 Hz vibration lasting the user-specified duration. There is no indication this change fixes a security vulnerability or affects end-user device security.

This commit is a routine hardware-driver refactor for the vibration motor (haptic feedback) in Trezor devices. It renames the driver, adds support for a second chip model, fixes how closed-loop vs open-loop motor control is configured, and improves error handling. There is no direct evidence in the commit that this fixes an exploitable security vulnerability; it appears to be a product-quality and maintainability improvement.

This commit only adds new expected screen-image fingerprints (called 'fixtures') for automated user-interface tests. It does not change any wallet code, transaction logic, or security behavior. There is no security issue here.

This commit only adds a new automated test for the Trezor hardware wallet. The test checks that a user can cancel a Bitcoin transaction signing flow from the amount confirmation screen on newer device models. It does not change any firmware, wallet logic, or security behavior. There is no security issue here.

This is a tiny documentation-only change. A helper function's type hint was updated from 'bool or None' to just 'bool', and the docstring line saying it could return None when no translation blob exists was removed. No actual code behavior changed, and there is no security relevance.

This commit fixes a bug in the Python Trezor library's WebUSB communication code. Previously, if a USB read operation timed out but had already received some data, that partial data was silently thrown away. Now the code checks whether any data was received before the timeout and uses it if it is a valid full chunk. This could prevent communication failures or dropped messages when talking to a Trezor device over USB, especially under timing pressure.

This commit is a large internal refactor of the Trezor bootloader's event loop, moving it from C into Rust and changing how screens handle USB/Bluetooth communication. The title and message explicitly call it a refactor with '[no changelog]', and there is no vendor statement that this fixes a security bug. The diff shows substantial code movement but no obvious new vulnerability. Because it is a wide-reaching rewrite of security-critical boot-time code, it carries ordinary implementation risk, but the available materials do not demonstrate a concrete security issue.

This commit is a test-infrastructure cleanup. It moves JavaScript code out of HTML files into a shared external file, bundles the pixelmatch image-comparison library locally instead of loading it from a CDN, and makes the UI test reports wait for images to finish loading before comparing them. There is no security-relevant change to the Trezor firmware or wallet behavior.

This commit adjusts how the Trezor bootloader's length is calculated and pads the bootloader image to a 512-byte boundary. The old calculation added the sizes of two memory sections, which could produce a value that does not match the actual padded image size. The new calculation uses a dedicated end marker, and the linker script now explicitly fills unused space with zeros and aligns the image. This is a defensive fix in low-level firmware packaging; it does not by itself show an exploitable bug, but misaligned or incorrectly reported bootloader sizes could theoretically cause verification or update failures.

A function that reads firmware image headers was returning the wrong kind of error value. In C, returning a special 'false' value where a pointer is expected can confuse the rest of the program, potentially causing crashes or allowing a malformed firmware image to be treated as valid. The patch makes all error paths consistently return NULL, which is the normal 'no valid header' indicator for this function.

This commit fixes the horizontal centering of a small vendor logo shown on the bootloader's 'unsafe firmware' warning screen. The old code subtracted 22 pixels from the screen width before dividing by two, which would slightly offset the 24x24 image. The new code simply centers the image using the screen's midpoint. There is no security-relevant change in the diff itself.

This commit improves error messages and logging in a Trezor production-test command file for the Tropic chip. It does not change program logic, access controls, or cryptographic checks; it only makes failures easier to diagnose by printing the actual numeric error code and correcting a misleading function name in one message. The change is in a prodtest (factory testing) tool, not in the wallet firmware that end users rely on for securing funds.

This commit simply moves an internal header file inclusion from one place to another. It is a routine code organization change with no visible security effect.

This commit only adds a new error code constant named TS_ENOINIT ('Not initialized') to a header file. It does not change any runtime behavior, fix a bug, or alter how the device handles errors. There is no security relevance visible in the change itself.