Trezor firmware

This commit changes how Trezor handles Ethereum transactions with large amounts of embedded data. Previously, the device always tried to 'clear sign' (show human-readable details on screen) for every transaction. Now, if the transaction data is larger than an internal storage limit, it skips clear signing and falls back to 'blind signing' (showing a generic warning). The change is described as a workaround because the clear-signing parser cannot fetch additional data chunks, and enabling it would remove the ability to fall back to blind signing. This is a defensive/hardening change rather than a fix for an active vulnerability, but it reduces the chance that a large malicious transaction could confuse the parser or the user.

This commit only adds and updates automated tests for Trezor's Ethereum 'clear signing' feature (ERC-7730 display formats). It does not change the firmware's security logic, so it is not a security patch. The tests verify that malformed or mismatched definitions are rejected, which is a normal defensive testing activity.

This commit adds the degree symbol (°) to French font files used on Trezor hardware wallets. It is a routine translation/localization update with no security relevance. There is no code change that could be exploited or affect device security.

This commit fixes a bug in the Trezor hardware wallet's low-level crash handler for STM32F4 devices. The handler decides whether a memory fault is a stack overflow by checking the wrong stack pointer due to an inverted branch condition. Before the fix, the device could fail to recognize or recover from a stack overflow on the main stack, potentially leaving it in a crashed or unresponsive state instead of resetting safely.

This commit adds support for ERC-4626 vault reward claims and changes how Trezor handles Ethereum transactions with extra trailing bytes (calldata suffix). Previously, vault transactions with any trailing bytes were rejected as errors. Now, the device accepts them but shows the extra bytes to the user as a 'Calldata suffix' screen. The change also introduces a new 'claim' function path, but the actual claim UI is stubbed out and returns None (disabled) for now. The commit is a feature addition, not a documented security fix, but it touches transaction parsing and user confirmation flows.

This commit is a code cleanup in the Trezor firmware's bootloader startup system. It replaces a fixed-size on-stack certificate buffer with a new 'reserve/commit/discard' API that lets the bootloader allocate space for the MCU attestation certificate directly in the shared startup-arguments buffer. There is no indication in the commit or supplied references that this fixes a security bug; it appears to be a defensive refactor to avoid large stack buffers and make the API more flexible.

This commit is a routine user-interface cleanup. It adds new translation strings for showing Ethereum transaction data size (for example, "Input data: 12 / 100 bytes") and moves the code that displays streaming data chunks so it can be shared across all Trezor firmware variants. There is no security-relevant change visible in the code.

This is a small internal code cleanup in the Trezor firmware's user-interface layer. It changes how the 'show address' screen is wrapped so that the layout object is managed within a scoped context manager rather than passed directly to a helper function. There is no indication this fixes a security bug or changes user-visible behavior.

This is a code cleanup change in the Trezor hardware wallet's user-interface layer. It introduces a new 'LayoutContext' wrapper so that on-screen keyboards and menus are always used inside a 'with' block, ensuring their memory is released promptly. The commit itself does not claim to fix a security bug, but it references an internal issue (#6811) about lifetime management, suggesting it is a defensive step against possible UI object lifetime problems.

This commit only adds two new optional data fields to an existing device-authentication proof message used in Trezor hardware wallets. It extends the protocol definition and the matching generated code in Python, Rust, and the core firmware so that future firmware can include an MCU (microcontroller) certificate and signature alongside the already-present Optiga and Tropic proofs. The change is additive and does not by itself alter any verification logic, cryptographic checks, or access controls visible in the diff.

This commit fixes a bug in how the Trezor hardware wallet's secure chip (Optiga) handles masked digital signatures. The fix changes two things: it now uses the actual returned signature length rather than the maximum buffer size when parsing the signature, and it explicitly uses the NIST P-256 curve instead of a variable curve parameter when removing the masking. The bug could potentially cause signature parsing to fail or behave incorrectly, especially if the returned signature was shorter than the maximum expected size. There is no public statement linking this to an active security vulnerability or attack.

This commit adds a new hardware-based device authentication feature for the Trezor T3W1 model. It lets the device prove its identity using a cryptographic certificate and signing key stored in the microcontroller (MCU). The change is a feature addition, not a fix for a known vulnerability. There is no evidence in the commit or supplied references that this resolves an active security issue or introduces a new attack path.

This commit adds a debug-only feature to the Trezor firmware emulator that lets software tests fake the device's battery and charging state. It does not change real hardware behavior. The new function is only compiled into emulator builds and only when Python optimization is disabled (debug builds). It is intended for automated testing, not for end-user devices.

This commit adds a new debug-only protocol message called DebugLinkSetBatteryState. It lets developers or test tools tell the Trezor emulator (a software version of the device used for testing) what battery and charging state to simulate. The change only touches protocol definitions and generated code; it does not add any logic that runs on a real device or handles secrets. It is marked for debug use only and is skipped in the legacy firmware build.

This is a harmless build-system cleanup. It teaches the firmware build scripts to remove haptic (vibration) and RGB LED code from devices that do not have those hardware features, and it sorts the list of feature flags alphabetically for easier reading. There is no security bug being fixed here.

This commit is a code refactor in Trezor's Rust THP (Trezor Host Protocol) library. It moves responsibility for assigning channel IDs from the internal library mux to the application using the library. The change also removes the requirement that credential stores/cloners implement the Clone trait, and adds a helper allocator for consecutive channel IDs. There is no direct evidence in the commit or supplied references that this fixes an active security vulnerability; it appears to be an architectural cleanup that may make misuse harder but also places more correctness burden on the application.

This commit expands Trezor's Ethereum 'clear signing' support to include ERC-4626 vault withdraw and redeem transactions, not just deposits. For transactions where the receiver or owner differs from the signer on an unknown vault, the device now falls back to blind signing instead of refusing outright. For known Trezor-listed vaults, mismatches still trigger a hard error. The change is a feature addition with intentional security trade-offs rather than a clear-cut vulnerability patch.

This commit is a small code cleanup in the Trezor hardware wallet's user-interface code. It changes how on-screen payment-request confirmation dialogs are created and destroyed, wrapping them in a 'with' block so they are cleaned up promptly. The developer notes this may be related to an out-of-memory (OOM) issue seen in automated tests, but the commit does not claim to fix a security vulnerability and no independent security references are provided.

This commit only regenerates Rust source files from protobuf definitions using a newer version of the protoc compiler (31.1 instead of 3.19.6). The only visible changes are updated version comments and a few reordered bytes inside generated metadata. There is no change to message logic, security behavior, or how the Trezor device handles data.

This commit is a routine user-interface feature addition for the Trezor hardware wallet firmware. It adds an optional 'external menu' flag to the 'show_info' screen layout, primarily for a new device design (Eckhart/N4W1). On older layouts, the flag is rejected with a 'not implemented' error. There is no security-relevant change visible in the code.

This commit is a routine user-interface feature change for Trezor hardware wallets. It lets the new 'Eckhart' screen layout optionally show an information screen with a disabled button (for example, a grayed-out 'Continue' that becomes active only after a timer or condition). Older layouts keep their previous behavior. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a product/usability feature.

This commit is a small code cleanup in the Trezor hardware wallet firmware. It changes how on-screen keyboards are managed during wallet recovery (when users type in their backup seed words). Previously, the code explicitly called a destructor-like method `keyboard.__del__()` inside a try/finally block to ensure cleanup. Now it uses Python's `with keyboard:` context manager, which is a more standard and safer way to guarantee cleanup happens. There is no direct evidence this fixes a security vulnerability.

This update fixes a memory issue in Trezor hardware wallets that could crash the device (out-of-memory) when confirming very large pieces of on-screen data. The fix ensures a temporary screen-layout object is explicitly released after use, rather than lingering in memory. It is a reliability/availability fix rather than a direct theft-of-funds vulnerability.

This commit is a code reorganization: it moves the code that initializes the hardware security boundary (TrustZone) from one internal system module into a dedicated security module, and makes sure every startup program calls it at the very beginning. The actual security settings look unchanged from the diff. It is not a fix for a known bug or vulnerability, but it changes where and when sensitive hardware is configured, which could matter for security if the move accidentally changes behavior or ordering.

This commit is a code cleanup that moves a small data table (the 'coreapp header') out of the processor's interrupt vector table file and into its own dedicated file. It does not change what the firmware does, only where the table is defined in the source code. There is no indication this fixes or introduces a security problem.