Trezor firmware

This commit fixes several build-compatibility problems in the Trezor firmware so it compiles on MacOS, clang, and newer gcc. The changes include using the correct local header file, avoiding a special memory section name that MacOS object files reject, silencing a compiler warning about an unused log variable in emulator builds, and fixing a 5-character string being squeezed into a 4-character space. These are primarily build/robustness fixes rather than patches for an active security vulnerability.

This commit adds a new internal reboot path that lets the Trezor Core firmware restart the device into the bootloader and immediately activate the USB/wire connection, skipping the usual intro screen that normally requires a finger tap. The change is intentionally limited: it does not approve any firmware installation, downgrade, or other security-sensitive action; it only changes which screen the bootloader shows first. It is exposed to unprivileged firmware through both a normal system call and a secure-monitor call, but it is not yet reachable from a host computer over USB. The main security consideration is that it slightly enlarges the attack surface for reboot-based attacks, though the commit message and code comments explicitly describe it as authorization-free and safe compared to the existing auto-upgrade reboot command.

This commit is a routine cleanup of an internal Python linting helper script. It removes unused features from `pyright_tool.py` (a tool that manages type-checker suppressions) and updates two comments in unrelated firmware source files to match a new alias format. There is no change to the actual Trezor firmware code that runs on devices, no security fix, and no vulnerability.

This commit is a routine size-optimization change for the Trezor firmware. It removes source filenames from compiled code to save 15KB of flash storage and rearranges linker sections. There is no indication this is a security fix or introduces a vulnerability.

This commit only rewrites test code to use named pytest parameters (adding readable IDs to test cases). It does not change any production firmware, wallet logic, or security behavior. There is no security issue here.

This is a small hardening change to the Trezor bootloader. It adds a compiler warning attribute to a security check function so that future programmers cannot accidentally call it and ignore its pass/fail result. The current code already uses the result correctly at both call sites, so there is no active bug being fixed—only prevention of a future mistake.

This commit is a routine firmware size optimization. It removes a developer-only memory debugging feature (meminfo) from production hardware builds to save about 7.3KB of flash storage, while keeping it available in emulator builds. There is no security vulnerability here.

This commit is a straightforward internal code cleanup in the Trezor firmware's user-interface code. It replaces a raw two-value pair (text label + intent) with a named struct called SelectMenuItem. There is no change to user-visible behavior, no bug fix, and no security-related change.

This commit adjusts memory layout alignment settings in the linker script used for Trezor's STM32F4 hardware wallet firmware. It moves a 512-byte alignment boundary from the end of one flash section to the end of another. The change is described by the vendor as fixing image size alignment on F4 devices. There is no explicit security claim in the commit, and the diff alone does not demonstrate a vulnerability or exploit path. It could plausibly relate to ensuring correct firmware image boundaries for secure boot or flashing, but that is speculative.

This commit only adds a test assertion to verify that the maximum passphrase length reported by a Trezor device matches the expected value for its model family (50 characters for legacy devices, 128 for newer 'core' devices). It is a pure test-code change with no product behavior change and no security fix.

This commit only changes automated test code for the Trezor hardware wallet. It makes passphrase display checks stricter in a test file (using exact equality instead of substring matching). There is no change to the actual firmware, wallet logic, or any code that runs on a user's device. It cannot affect real users or introduce a security vulnerability.

This is a small internal code cleanup in the Trezor firmware's PIN entry screen. It swaps one fixed-size text container (`String<99>`) for another (`ShortString`) that was already enlarged to 128 bytes in a prior commit. The behavior and safety limits remain the same, and there is no indication of a security fix.

This commit changes how the Trezor firmware's embedded linker scripts reserve memory for special buffer sections. It marks sections named .buf and .no_dma_buffers as NOLOAD, meaning the linker will reserve RAM space for them but will not include their initial contents in the firmware binary or copy them during startup. Without NOLOAD, these uninitialized buffers could be included in the binary image, increasing its size and potentially causing startup initialization issues. The change is a correctness fix for embedded memory layout, but the commit message does not frame it as a security fix and no exploit is demonstrated.

This is a code cleanup in the Trezor bootloader. It removes a list of commands that was no longer doing anything useful, because a simpler check already covered all cases. There is no security bug being fixed here; the change only makes the code easier to understand and prevents future mistakes where someone might add a command to the now-deleted list and expect it to matter.

This commit changes how a memory buffer section named .buf is handled during the build process for the Trezor Model T (T2T1) hardware wallet. By marking it as NOLOAD, the linker no longer includes this uninitialized buffer in the firmware image file, which prevents the firmware from exceeding its allowed flash storage region. This is a build/linker fix that avoids a firmware size overflow; it does not by itself appear to be an exploitable vulnerability, but overflowing a flash region could in some cases cause build failures, boot issues, or undefined behavior if an oversized image were written to the device.

This commit is a build-system feature change. It lets developers use the Address Sanitizer (ASAN) debugging tool with all Trezor firmware projects, not just the emulator. It also adds a guard that stops ASAN from being used in real hardware builds, where it is unsupported. There is no security vulnerability here.

This commit adds automated tests for the ECDSA cryptographic code in the Trezor firmware. It also introduces a small, safer wrapper type (RecId) for signature recovery IDs so only valid values (0-3) can be passed to the underlying C code. There is no fix for a known vulnerability here; it is a hardening and test-coverage change.

This commit reorganizes how a test-only random number generator and certain Bitcoin-related cryptographic error handlers are wired up in the Trezor firmware's Rust crypto code. It moves an insecure PRNG used only in unit tests into its own module and exports it under a detectable name so test builds can find it. It also moves default error callbacks for the secp256k1-zkp library from the Python module layer into the core crypto crate so all users of the crate share them. The change removes a Python ValueError raise for illegal library arguments, replacing it with a system error shutdown. There is no direct evidence in the commit of a vulnerability being fixed; it reads as a refactoring to support testing and a new cryptographic feature (zero-knowledge proofs).

This commit is a code-quality refactor in the Trezor firmware's Rust layer. It introduces a new mutable-slice helper (CSliceMut) and changes the existing CSlice so that empty/NULL slices return an empty Rust slice instead of an optional value that callers had to unwrap. The change is described by the developer as fixing 'obscure provenance bugs' and aligning safety properties. There is no direct evidence in the commit of an exploitable vulnerability; it reads as defensive hardening of the boundary between C and Rust code.

This commit only adds documentation comments to a C header file. No program code was changed, so it cannot introduce or fix a security bug by itself. The comments describe how the storage API is already supposed to behave, including rules about which pointer arguments may be NULL.

This commit tightens a safety check in the Trezor hardware wallet's user-interface code. It makes sure that a small on-screen menu component can hold at least as many items as the firmware might ever ask it to display, preventing a capacity mismatch that could crash the device when a user is choosing recovery-seed word counts or similar options. There is no direct evidence in the commit that this crash was exploitable to steal funds or bypass security.

This commit is a straightforward internal code cleanup. It moves two configuration constants between header files to remove a circular include dependency between the flash and storage modules. There is no user-facing change, no bug fix, and no security-sensitive behavior change.

This commit fixes a capacity mismatch in the Trezor hardware wallet's on-screen menus. A global limit allowed up to 6 menu entries, but the internal storage for two menu layouts only held 5. When a 6-item menu was built, the code would panic (crash) instead of showing the menu. The patch raises both storage capacities to 6 and adds compile-time checks so the bug cannot silently recur if the global limit is changed again. The crash is a denial-of-service issue for the device UI, not a direct theft-of-funds vulnerability.

This commit is a routine housekeeping change that swaps the Python code-formatting tools used in the project from `black` and `isort` to `ruff`. It updates configuration files, build scripts, and reformats many source files to match the new tool's style. There is no change to what the software actually does, no new features, and no indication of any security problem or fix.

This commit is a code cleanup in the Trezor firmware's user-interface layer. It moves a small 'menu item intent' type to a better location, fixes a minor error-handling inconsistency, and reorders some on-screen menu entries so the cancel option appears first. There is no direct evidence this fixes an exploitable security vulnerability, but the reordering could be a defensive usability improvement to prevent accidental destructive actions.