Trezor firmware

This commit fixes a low-level bug in the Trezor hardware wallet's core firmware. Before pushing data onto a task's stack, the code now ensures the correct memory protection region (called an 'applet') is activated. Without this fix, the device could potentially access or corrupt memory it shouldn't while managing internal tasks, which on a security device like a hardware wallet could undermine isolation between sensitive operations.

This commit marks several fixed data objects as read-only constants so the compiler can place them in flash memory (.rodata) instead of writable RAM. This is a hardening change: it prevents accidental or malicious code from modifying values like the device model name, USB product strings, firmware revision, and the base32 alphabet. There is no direct evidence in the commit that an actual exploit exists; it is a defensive memory-layout fix.

This commit adds a new 'thread-local storage' (TLS) memory section for Trezor's coreapp on newer hardware models. It changes how the device saves and restores small, per-task memory areas when switching between tasks. The change is a feature implementation, not a fix for a known security bug. There is no evidence in the commit or supplied references that this addresses an active vulnerability or was disclosed as security-relevant.

This commit changes how the Trezor firmware's embedded Python interpreter handles short 'atomic' critical sections. Previously, these sections disabled interrupts using a privileged system call. Now they are replaced with no-ops (do nothing). The stated reason is to remove interrupt locking from unprivileged code. The change could affect timing, race conditions, or security properties that relied on interrupt masking for atomicity, but the diff alone does not show an exploitable bug or a disclosed vulnerability.

This is a one-line fix in an automated GitHub workflow that pulls translations from Crowdin. The change adds 'uv run' before the 'make' command so the build environment finds the correct Python tooling. There is no indication this affects device firmware, user funds, secrets, or security.

This is a routine fix to a GitHub Actions workflow that pushes translation source files to Crowdin. It renames the job, adjusts how the environment is set up, and corrects the secret name used for the Crowdin API token. There is no security-relevant change.

This commit adds a manually-triggered GitHub Actions workflow that downloads translated text files from the Crowdin service, merges them into the project's language files, and opens a pull request. It does not change any firmware code, wallet logic, or cryptographic handling. There is no indication this introduces a security vulnerability.

This commit updates the Tron coin support in Trezor firmware to use the newer 'session' API and changes the Tron message type numbers. It also removes unused Tron transaction-signing message definitions and limits Tron support to debug builds only. There is no direct evidence in the commit of a security vulnerability being fixed; it appears to be a maintenance and integration cleanup change.

This commit adds support for retrieving Tron cryptocurrency addresses on Trezor hardware wallets. It is a feature addition that extends existing address-derivation infrastructure to a new blockchain. There is no indication in the commit that it fixes a security bug or introduces a vulnerability.

This commit is a routine cleanup of on-screen text for the Trezor hardware wallet. It removes English text strings that are only used by the older 'Bolt' user-interface layout, leaving those strings empty for newer layouts (Caesar, Delizia, Eckhart) where they are not displayed. There is no change to security logic, cryptography, or how the device protects funds.

This commit fixes how the Trezor hardware wallet schedules its automatic deep-sleep (hibernate) timer on STM32U5 devices. It replaces a simpler one-shot RTC timer with a new RTC scheduler that tracks event IDs, and it now properly cancels pending hibernate events when the device wakes up. The change appears to be a bug-fix for power management reliability rather than a security patch, but a mis-scheduled hibernate event could theoretically affect device availability or battery life.

This commit refactors how the Trezor hardware wallet talks to its built-in Infineon OPTIGA security chip. It splits the old 'init/deinit' routines into smaller steps (power up/down, open/close channel) and adds new suspend/resume logic. The goal appears to be reducing wear on the OPTIGA chip by avoiding full power cycles when the chip's internal security-event counter (SEC) is high. There is no direct evidence in the commit that this fixes a known exploitable vulnerability, but it changes sensitive secure-element lifecycle code and introduces new secure-monitor call interfaces that could affect device security if misused.

This commit changes how the Trezor hardware wallet's low-power suspend/resume routine handles the Optiga security chip. Previously, the device fully shut down and later re-initialized Optiga during suspend and resume. Now it keeps Optiga powered and uses new suspend/resume helpers, with the suspend step moved out of secure mode so it can access the real-time-clock scheduler while waiting for an internal security counter to clear. The change is framed as a feature/refactor, but it touches security-critical hardware state and could affect secure-key availability or side-channel behavior if the new helpers are not equivalent to the old init/deinit cycle.

This commit refactors the real-time clock (RTC) wakeup system in Trezor's embedded firmware so that multiple timed wakeup events can be queued and scheduled instead of only one at a time. It is a feature addition ("Introduce rtc event scheduler") with no changelog entry. The change is mostly architectural: it moves single-wakeup logic into a small scheduler and changes the timer API from a relative number of seconds to an absolute RTC timestamp. There is no direct evidence in the commit that this fixes a security vulnerability, and the vendor does not describe it as security-relevant.

This commit is a straightforward build fix that changes which internal header files three source files include when the Optiga security chip support is enabled. It replaces references to configuration and transport headers with a single initialization header. There is no indication in the commit that this fixes a security vulnerability or changes runtime behavior in a security-relevant way.

This commit fixes the Trezor emulator build on macOS. It replaces Linux-only socket flags (SOCK_NONBLOCK and MSG_DONTWAIT) with portable equivalents that work on both Linux and macOS. The socket is still set to non-blocking mode using fcntl, and the send/receive calls now rely on that non-blocking state instead of per-call flags. There is no security-relevant change.

This commit only removes an old TODO comment from a production-test source file. No code behavior changes, no bug fix, and no security relevance is present in the diff or commit message.

This commit refactors how the Trezor firmware's production-test code establishes secure sessions with the Tropic secure chip. It replaces scattered, manually-managed key-loading and session-start code with a single internal helper, `tropic_custom_session_start()`, and adds a way to invalidate an existing session before starting a new handshake. The change is described by the vendor as a refactor and improvement, not as a security fix. The diff does not show an obvious exploitable vulnerability, but it does remove several direct `memzero()` calls that cleared private key buffers in production-test routines; that cleanup is now handled inside the new helper. Because the commit touches sensitive pairing-key handling and session state, it has defensive-security relevance, but there is no disclosed incident or CVE.

This commit fixes a production-test command used inside Trezor's factory tooling. The command for reading a FIDO security key was failing because it tried to read the key without first starting a secure session with the Tropic chip. The patch adds the missing session-start step before reading the key. It is a bug fix in internal manufacturing diagnostics, not a user-facing wallet security flaw.

This commit adds a small optimization to the Tropic secure-element integration in Trezor firmware: if a secure session is already active for the same pairing key, the code now skips re-establishing it. The change is defensive in nature and appears aimed at avoiding redundant session setup, not at fixing a known vulnerability. There is no direct evidence in the commit that this resolves an exploitable security flaw.

This commit changes a function parameter declaration from an empty array syntax to a pointer syntax in the Noise protocol cryptography code. It is purely a coding-style/compiler-warning fix with no functional change to the program's behavior or security.

This commit is a code cleanup: it moves the Tropic chip certificate cache out of the production-test command file and into the shared Tropic driver, then exposes two helper functions so other code can fetch the cached public key and certificate chain. There is no visible security bug being fixed or introduced in the diff itself.

This commit simply removes the Italian language translation files and related font glyph definitions from the Trezor firmware. It is a routine localization cleanup with no security relevance. No code that handles cryptography, authentication, or device security is changed.

This commit is a user-interface improvement for the Tropic secure chip integration. It moves progress-bar updates so they happen automatically during built-in hardware delays, rather than being sprinkled manually around cryptographic operations. There is no security vulnerability here; it is a code-quality and UX refactor.

This commit only updates version numbers and translation metadata. It does not change any program logic, fix any bug, or alter any security behavior. There is nothing here that could directly affect security.