Trezor firmware

This commit only changes test helper code in the Trezor Python client library. It refactors how automated tests navigate on-device menus for newer Trezor hardware models (Eckhart and Delizia). There is no change to firmware runtime, wallet logic, cryptography, or any user-facing security behavior. It is a testing infrastructure improvement with no security relevance.

This commit is a test-infrastructure change for the Trezor hardware wallet's Delizia user interface. It adds a new flag so automated tests can navigate an older style on-screen menu during transaction confirmation flows. There is no user-facing behavior change, no fix for a bug, and no security relevance visible in the code or commit message.

This is a small internal code cleanup for the user interface of a new Trezor device layout (codenamed 'Eckhart'). It adds a marker flag called is_cancel to buttons that represent a 'Cancel' action, so automated testing/debug tools can identify them more easily. The visible behavior of the device does not change.

This is a routine build tooling update. The commit replaces one Nordic programming tool (nrfjprog) with its newer replacement (nrfutil) in a CMake board configuration file. It does not change any firmware code that runs on the Trezor device or affect how the device operates.

This commit adjusts linker scripts that control how the Trezor hardware wallet's bootloader and security monitor (secmon) binary images are laid out in flash memory. It reduces alignment padding from 512 bytes to 4 bytes and changes how unused space at the end of each image is filled with zeros. The change appears to be a correctness fix for image padding rather than a fix for an exploitable memory corruption bug, but the exact security implications are not stated by the vendor.

This commit changes how many wrong PIN attempts are allowed on Trezor hardware wallets that use a component called Tropic. Previously, devices using both Tropic and Optiga security chips were limited to 10 PIN attempts, while devices using only Tropic were allowed 16. The change makes all Tropic-based devices use 10 attempts, matching the stricter limit. This is a defensive consistency fix, not an active vulnerability patch, but it reduces the attack surface for PIN brute-force attempts on Tropic-only devices.

This commit simply deletes an old internal helper script that was used to update minimum firmware version numbers in the Python library. The script fetched public release data from Trezor's servers and rewrote a source file. Removing it does not change any runtime code, device firmware, or installed library behavior, and there is no indication it fixed or introduced a security problem.

This commit simply bumps the version of a Rust dependency called zeroize from 1.7.0 to 1.8.2. zeroize is a library used to securely erase sensitive data from memory. The change itself is a routine version update with no visible security fix or vulnerability being addressed in the commit. There is no indication this update fixes a known security problem in Trezor firmware.

This is a one-line change adding a missing C standard header file (`stdbool.h`) to a cryptographic header. It enables the use of `bool`, `true`, and `false` types in the file. There is no functional code change, no bug fix, and no security-relevant behavior change visible in the diff.

This is a routine dependency update for the Rust build tool bindgen inside Trezor firmware. It bumps bindgen from version 0.62.0 to 0.72.1 and adjusts the code to match the newer API. The change removes a small workaround that forced a function signature to be read as non-const pointers, because the newer bindgen now generates the correct const pointers. There is no direct security fix here, but keeping build tools current reduces the chance of future bugs or build issues.

This commit fixes a compiler-specific alignment definition for AES cryptographic data structures. Previously, the code only forced memory alignment when compiled with GCC on 64-bit x86, but not when compiled with Clang on the same architecture. The change makes Clang behave the same way as GCC, ensuring the AES context has the same memory layout regardless of which compiler is used. This is a hardening/fix for consistency in cryptographic code, but the commit message does not describe an active exploit or security vulnerability.

This commit is a code cleanup: it removes duplicate helper macros from several cryptography modules and replaces them with a single shared macro. There is no change to user-facing behavior, no bug fix, and no security patch. It is purely an internal refactoring to make the code easier to maintain.

This commit adds Rust wrappers around existing low-level cryptographic functions in the Trezor firmware so they can be used by a new feature called THP. It does not appear to fix a known bug or vulnerability. The changes are mostly a refactor: they expose AES-GCM, Curve25519, HMAC-SHA256, SHA-512, CRC32, and a random-byte helper to Rust code, and add unit tests. There is no direct evidence in the commit that this resolves a security issue, but any new crypto binding introduces a small chance of misuse or memory-safety mistakes.

This commit fixes a bug in the Trezor hardware wallet's THP (Trezor Host Protocol) communication code. Previously, if the final acknowledgment (ACK) from the computer/app was lost, the device would not properly advance its internal sequence bit. This could cause the next message to use the wrong sequence number, potentially confusing the host software (Trezor Suite) and disrupting communication. The fix ensures the sequence bit is always advanced after a write attempt, even if the ACK is lost or the write is blocked.

This commit removes the ability to download or install 'beta' firmware versions through the Trezor Python command-line tool. It is a feature cleanup, not a security fix. There is no indication it patches a vulnerability.

This commit only changes a test command in the build Makefile. It wraps an emulator sanity check with a 10-second timeout so automated tests don't hang indefinitely if the emulator fails to start. There is no change to firmware code, cryptography, device behavior, or anything users interact with.

This is a test-only change that adds a device wake-up step for one specific Trezor model (T3W1) in an automated test. It does not modify the firmware or any production code, so it has no direct security impact on users.

This commit changes an automated GitHub workflow so that translation-sync pull requests are created using a dedicated bot account's token instead of the repository's default GitHub token. It also adds one employee as the assignee and reviewer. The change is a CI hardening/fix, not a vulnerability in the Trezor firmware itself. There is no direct evidence in the commit that this fixes an active security issue, but using a scoped bot token is generally safer than the default token because it limits what the workflow can do.

This commit changes how the Trezor firmware's embedded Python interpreter handles short 'atomic' critical sections. Previously, these sections disabled interrupts using a privileged system call. Now they are replaced with no-ops (do nothing). The stated reason is to remove interrupt locking from unprivileged code. The change could affect timing, race conditions, or security properties that relied on interrupt masking for atomicity, but the diff alone does not show an exploitable bug or a disclosed vulnerability.

This commit adds a new 'thread-local storage' (TLS) memory section for Trezor's coreapp on newer hardware models. It changes how the device saves and restores small, per-task memory areas when switching between tasks. The change is a feature implementation, not a fix for a known security bug. There is no evidence in the commit or supplied references that this addresses an active vulnerability or was disclosed as security-relevant.

This commit changes a low-level firmware file that handles system calls on Trezor hardware wallets. It disables the compiler's stack protector (a safety feature that helps detect certain memory corruption bugs) specifically in the 'syscall stubs' code. The commit message frames this as a feature and does not explain why the protector is being disabled or claim any security benefit. On its own, disabling a security mitigation is a security signal, but the diff is too small to determine whether this introduces a real vulnerability or is a necessary workaround for a technical constraint.

This commit reworks how the Trezor Core firmware configures the memory protection unit (MPU) when switching to small helper programs called applets. It adds a dedicated thread-local storage (TLS) region for applets and fixes a bug where region 4 was being configured from the wrong layout field (code2 vs data2). The changes are framed by the developer as an improvement, not a security fix, and no external security references are provided.

This commit fixes two low-level operating-system bugs in Trezor's embedded firmware. First, it corrects how the kernel waits for hardware events (button presses, USB packets, etc.) when more than one mini-program ('applet') is running. Previously, the kernel stored direct pointers to each waiting task's event masks, which could create race conditions or incorrect results when multiple tasks polled at the same time; now it keeps private copies and only writes the result back when the task actually wakes up. Second, it fixes a bookkeeping bug where new system task IDs were never marked as used, which could eventually hand out the same ID twice. It also makes sure the memory-protection unit (MPU) is switched to the correct applet before a task starts running or is woken up. The commit is tagged '[no changelog]' and gives no security context, so while the bugs are real, there is no direct evidence they are exploitable for theft of funds or secrets.

This commit marks several fixed data objects as read-only constants so the compiler can place them in flash memory (.rodata) instead of writable RAM. This is a hardening change: it prevents accidental or malicious code from modifying values like the device model name, USB product strings, firmware revision, and the base32 alphabet. There is no direct evidence in the commit that an actual exploit exists; it is a defensive memory-layout fix.

This commit is a small internal cleanup of how the Trezor firmware's kernel talks to applets (isolated mini-programs). It removes a direct pointer to the applet's header from the applet structure and instead reads that header from the start of the applet's code area when needed. The change is described as a refactor with no changelog. There is no direct evidence in the commit that this fixes a security vulnerability, but it does reduce the chance that a stale or manipulated header pointer could be used.