Trezor firmware

This commit simply swaps in a newer pre-built bootloader binary for the T3W1 hardware model used in QA/testing, and updates the matching hash list so the firmware recognizes it. There is no source-code change, no description of a security fix, and no public reference linking it to a vulnerability.

This commit removes a 'Go to bootloader' menu option from normal user builds of the Trezor hardware wallet, keeping it only in debug/developer builds. The change prevents an ordinary user from intentionally or accidentally rebooting the device into bootloader mode through the on-device menu. While entering bootloader mode is a normal part of firmware updates, exposing it in production builds could let a local attacker with brief physical access force the device into a state where they could attempt to install modified firmware or interfere with an update. The patch is narrow: it only hides the menu item behind a debug-only compile flag, so the underlying bootloader entry mechanism still exists for legitimate update workflows.

This commit simply shortens the on-screen label for a device menu item from 'Regulatory certification' to 'Regulatory' (or translated equivalents) and updates the internal translation key from regulatory_certification__title to regulatory__title. It is a cosmetic UI text change with no security relevance.

This commit adds a user-facing warning message on Trezor devices when the connected computer or phone is slow to respond during a button-confirmation step. It is a usability improvement to prevent users from seeing a confusing blank screen; it does not fix a vulnerability and does not introduce a new attack path.

This commit simply reverts a previous internal renaming of a user-interface text label. It changes the translation key for a Bluetooth 'Waiting for connection...' message from 'words__waiting_for_host' back to 'ble__waiting_for_host' and updates the generated translation files accordingly. There is no security relevance.

This is a visual layout tweak for the Trezor T3W1 hardware wallet. It slightly shrinks the plus/minus buttons on a settings screen so that translated text (like the word "seconds") does not get cut off. There is no indication of a security vulnerability or exploit.

This commit changes the bootloader menu on a Trezor hardware wallet so that the 'Pair new device' Bluetooth option is grayed out when Bluetooth Low Energy (BLE) is disabled. It is a UI consistency fix rather than a fix for an exploitable vulnerability. There is no evidence in the commit or supplied references that this resolves a security issue.

This bootloader patch makes the device erase a special protected memory region (backup RAM) when the user enters a 'wipe code' to factory-reset the device. Without this cleanup, sensitive leftovers could remain in that protected memory after a wipe. The change is small and defensive, but the commit message does not explain what specific risk it fixes.

This commit changes the Trezor bootloader so that Bluetooth Low Energy (BLE) settings are remembered across reboots. Previously, the bootloader would turn BLE back on even if the user had turned it off. Now the bootloader reads a saved 'BLE enabled' flag from backup memory and only enables BLE if the user had left it on. The pairing/setup workflows still force BLE on because they need it. This is a privacy/usability fix rather than a critical security patch, but it prevents an unwanted BLE radio from being active when the user expects it to be off.

This commit adds a way for the Trezor device to tell the connected computer or phone when its power source changes (for example, when USB is plugged in or a wireless charger is placed nearby). It also exposes two new status flags, usb_connected and wireless_connected, in the device's feature report. There is no direct security fix here; it is a feature that improves real-time status reporting.

This is a small internal code cleanup in the user-interface code for the Trezor hardware wallet's newer 'Eckhart' layout. It removes a special 'pagination hint' builder flag and instead lets callers pass an ordinary page-counter hint component. The visible behavior is meant to stay the same: a page counter appears only when content spans more than one page. There is no indication this change fixes a security bug or introduces a vulnerability.

This is a routine user-interface code cleanup for the Trezor hardware wallet. It changes how on-screen navigation controls (page counters and action bars) are shown, hiding them when text fits on a single page. There is no indication this fixes a security bug or introduces a security risk.

This commit is a code-quality and accuracy improvement for how the Trezor firmware estimates how long PIN operations will take. It replaces a single coarse heuristic with finer-grained per-command timing estimates for the Optiga and Tropic secure chips, adds a helper that models the chip's security-event-counter throttling, and moves the estimate logic closer to the functions it describes. There is no direct security vulnerability being fixed; the change is about making progress-bar timing more accurate, which indirectly helps user experience and may make side-channel timing analysis slightly more predictable. The commit message says '[no changelog]' and does not claim to fix a security issue.

This commit changes how the Trezor hardware wallet's earliest startup code (boardloader and bootloader) uses internal memory on the T3B1 model. It shifts small data and uninitialized-memory sections from one RAM bank (AUX1_RAM) to another (MAIN_RAM), and slightly adjusts the size and start addresses of those RAM regions. The title says this is to 'use ECC SRAM'—memory with built-in error-correction, which is a reliability/hardening improvement, not a vulnerability fix. There is no direct evidence in the commit of a security bug being patched.

This commit removes a special firmware memory section called ".confidential" that was meant to keep sensitive data (like cryptographic keys and seed-derived values) separate from ordinary memory. Previously, variables marked with a CONFIDENTIAL attribute were placed in this dedicated RAM region and copied from flash at startup. The patch deletes that whole mechanism across all Trezor models and instead marks sensitive local variables with a new LOCAL_CONFIDENTIAL macro. On the legacy build this still maps to the old behavior, but on the modern STM32 builds it effectively becomes a no-op, meaning those sensitive buffers now live in normal RAM/data sections. The change is presented as a cleanup, but it reduces a defense-in-depth isolation feature and could make it easier for a successful attacker to locate or extract secret material in memory.

This commit is a straightforward user-interface feature: it makes the Trezor T3W1 device show a special LED lighting effect while Bluetooth Low Energy (BLE) pairing is in progress. It refactors how the firmware tracks LED state so that the renderer can request either a static color or a hardware-driven effect (pairing/charging). There is no security-relevant change visible in the diff.

This commit is a routine hardware driver improvement. It makes the screen backlight brightness curve adjustable per display panel by passing a gamma exponent into the backlight driver. There is no security-relevant change: no memory corruption, no cryptographic code, no privilege changes, and no user data handling.

This commit adjusts the screen brightness numbers used by the Trezor T3W1 hardware wallet so that the actual perceived brightness stays the same after a change in how brightness is calculated. It is a display-calibration tweak, not a security fix or vulnerability. The only user-visible effect should be that brightness levels look the same as before.

This commit is a straightforward internal code cleanup for the T3W1 hardware wallet's on-device menu. It changes how menu choices are represented behind the scenes (from unique object tokens to plain integer codes) and reorganizes the Python handler code into smaller functions. There is no indication this fixes a security bug or introduces a new vulnerability.

This commit changes how Trezor stores wallet backup words (mnemonics) for Cardano support. It now keeps an extra binary copy of the mnemonic in device storage, separate from the encrypted text version. The change is described as a feature, not a security fix. It does not appear to introduce an obvious remote exploit, but it does add a new storage location holding sensitive seed material and includes a debug-only option that lets invalid mnemonics be loaded without raising an error.

This commit only adds a new automated test to the Trezor firmware test suite. It checks that Cardano public keys and addresses stay the same before and after a firmware upgrade that migrates internal app storage from version 2 to the current version. There is no change to the actual firmware code, wallet logic, or security behavior.

This commit only updates Cardano unit tests to convert text seed phrases into binary format before passing them to a cryptographic function. It does not change any production wallet code, user-facing behavior, or security-sensitive logic. There is no indication this fixes or introduces a vulnerability.

This commit simply fills in a previously empty placeholder with the real production public key used to verify signed payment requests. By itself, it is a routine configuration/key-installation change, not an exploitable vulnerability. The only security-relevant observation is that before this commit, payment-request signatures using this key could not have been validated, so the feature would not have worked in production.

This commit removes the 'experimental' label from two Trezor firmware features: PaymentRequest (used in several cryptocurrency transaction flows) and GetNonce (a random-number request). It also updates generated code and tests accordingly. The change itself is a feature graduation, not a fix for a known security bug. There is no direct evidence in the commit that it patches an active vulnerability, but it does widen the audience for these features by removing the experimental opt-in requirement.

This commit is a straightforward internal code cleanup: it splits one Python/C function that handled three different reboot behaviors into three separate, clearly named functions. There is no change to what the device actually does during a reboot or firmware upgrade, and no security bug is introduced or fixed.