Trezor firmware

This commit is a straightforward code cleanup: it moves the existing firmware-validation logic out of the bootloader's main.c into a new file (fw_check.c/h) and updates the surrounding code to use the new structure. There is no change to what the bootloader actually checks or how strict it is. It is a pure refactor with no security-relevant behavior change visible in the diff.

This commit fixes a theoretical 'division by zero' bug in the progress-bar code shown on the Trezor hardware wallet during Bitcoin transaction signing. The bug could only crash the device if internal counters used to calculate progress ever became zero, which the developers describe as 'hypothetical.' It does not affect cryptographic signing itself or expose funds.

This commit fixes a coding issue in the older Trezor firmware where a temporary memory buffer could be created with zero size when handling multi-signature Bitcoin wallets. The fix replaces a variable-length buffer with a fixed maximum-size buffer. A zero-length variable-length array is undefined behavior in C and could, in theory, be exploited to destabilize the device, though the commit itself does not describe a practical attack.

This commit fixes a subtle arithmetic bug in older Trezor hardware wallets related to how a 'busy' screen timeout is calculated. The old code added a delay value to the current time and compared it directly, which could misbehave when the internal millisecond counter wraps around to zero after a long period. The new code stores the start time and duration separately and checks whether the elapsed time is still within that duration, which handles wraparound correctly. This could affect whether the device reports itself as busy, shows the right screen, or clears the busy state at the expected time.

This commit fixes several numeric overflow bugs in the older Trezor One (legacy) firmware. The most user-visible issue was a fee-rate display overflow: when a transaction used extremely large input amounts, multiplying the fee by 100 to show decimal places could wrap around to a tiny-looking fee, potentially tricking a user into approving a much higher fee than shown. The patch also prevents overflow when summing duplicate NEM mosaic quantities and stops BIP-32 child derivation once the maximum derivation depth is reached. A comment-only change notes that PINs can be up to 50 characters, but no code behavior was altered there.

This commit changes how the Trezor hardware wallet uses a special secure-chip feature called 'mac-and-destroy' slots during PIN verification. Previously, the same small set of slots was used every time the PIN was set or checked. Over many PIN changes, repeatedly erasing and rewriting those same slots could physically wear out that part of the secure chip. The patch spreads the wear across 64 slots by rotating which slot is used based on how many times the PIN has been changed. This is a reliability and physical-security improvement, not a fix for an obvious remote attack. There is no claim in the commit that this resolves a known security bug or reported vulnerability.

This commit is a small internal refactor of the Trezor firmware's Tropic secure-element integration. It adds a software cache for a hardware-backed 'change PIN counter' so the firmware does not have to repeatedly ask the secure chip for the same value during PIN operations. There is no indication in the commit or title that this fixes a security bug; it appears to be a performance or timing-predictability improvement.

This commit is a code cleanup: it moves the initialization of the HSI (High-Speed Internal) clock from the RGB LED driver into the system startup code. The change removes a duplicate HSI startup block and stops the system from turning HSI off after switching to the external HSE clock. There is no indication this is a security fix or introduces a security vulnerability.

This commit hardens the security boundaries inside Trezor's STM32U5 microcontroller. It moves USB power initialization into the trusted secure monitor, restricts access to sensitive system registers (power, clock, cache, watchdog, RAM config), and locks down the TrustZone configuration so it cannot be changed later. These are defensive improvements that reduce the attack surface if untrusted code runs on the device, but the commit itself does not fix a known exploitable bug.

This commit changes the order in which a Trezor hardware wallet resumes internal components after waking from a low-power suspend state. Previously, secure drivers were resumed after the Optiga security chip was resumed. The fix moves secure-driver resumption before Optiga resumption. The commit title says this fixes a problem that occurs when the Optiga chip is properly paired and the bootloader is locked. Without more context, the exact security impact is unclear, but an incorrect resume order could in principle cause a secure-driver failure or leave a security-critical component in an inconsistent state during wake-up.

This commit adds a new cryptographic signature entry to a JSON file that records approved translations for the Trezor hardware wallet firmware. The signature verifies that the translation data for version 2.9.5.0 is authentic and has not been tampered with. There is no code change and no direct security vulnerability visible in the diff itself.

This commit replaces a binary firmware component called 'secmon.bin' for the T3W1 hardware model. The change is a binary blob update with no source code diff, no changelog entry, and no description of what changed inside the file. There is not enough public information to determine whether this is a security fix, a routine update, or something else.

This commit simply adds a new firmware version number (2.9.5) for one Trezor device model (T3W1) to a release-tracking JSON file. It is an administrative metadata update with no code changes and no apparent security relevance.

This commit only updates the release date text in two changelog files, changing 'internal release' to '28th November 2025'. It does not modify any code, firmware logic, or security behavior. There is no security issue present.

This commit is just a documentation update: it adds a changelog note saying that firmware version 2.9.5 fixes a bug where the device's tamper-detection red screen of death (RSOD) was not appearing. The actual code fix is not shown in this commit, so we can only judge the issue from the one-line changelog entry. If the RSOD really failed to display when a tamper event happened, a local attacker who opened or probed the device might not trigger the expected warning, potentially hiding physical tampering. However, this commit itself changes no code, so its direct security risk is low and the severity depends entirely on the unseen fix.

This commit updates a pre-built binary file used only in developer builds of the Trezor T3W1 hardware wallet's secure monitor, and adds a one-line comment explaining how that developer binary is built. There is no indication this affects production firmware or fixes a security vulnerability. It appears to be a routine development-only maintenance change.

This commit adjusts the default screen brightness for the Trezor T3W1 model during production testing. It changes one number in a factory test program from 85 to 155, matching other models. There is no security issue visible in this change.

This commit changes the Trezor firmware emulator's fake Bluetooth driver so it starts in an 'enabled' state by default. It only affects the Unix emulator build used for software testing, not real Trezor hardware. The change moves socket setup from the 'start' routine to the 'init' routine and adds a new flag tracking whether communication is running. There is no direct evidence this fixes a security vulnerability; it appears to be an emulator behavior or test-fix change.

This commit is a routine housekeeping change that only updates version numbers from 2.9.6 to 2.9.7 for the main firmware and from 1.0.5 to 1.0.6 for the security monitor, plus refreshes translation file metadata and their cryptographic signature. There are no code behavior changes, no bug fixes, and no security-related modifications visible in the diff.

This is a small build-script change for the Trezor hardware wallet firmware. It changes the CI build so that only the final firmware/bootloader files are copied out of the Docker container, instead of the entire build folder. The stated reason is to fix a CI failure, not to fix a security bug. There is no direct evidence in the commit that this is a security fix.

This commit only reduces the amount of text printed during a Docker build script. It adds quieter download flags for wget/curl and removes the terminal allocation flag from the Docker run command. There is no security-relevant change.

This is a minor build-script change that adds the secure-monitor (secmon) component to the list of firmware artifacts whose fingerprints are collected during CI. It also switches the file-existence check from `-f` to `-s` so that empty placeholder files are skipped. There is no user-facing or security-relevant code change.

This commit adds a new command-line option to the Trezor bootloader emulator that lets developers pre-load a firmware image into the emulated flash memory before running tests. It is a development/testing convenience feature and does not change the real hardware bootloader or wallet behavior.

This commit adds a build-time and emulator option to turn off visual animations in the bootloader. It is a routine developer convenience change and does not fix, introduce, or change any security behavior.

This commit adds a new command-line option (-w) to the Trezor bootloader emulator, a software-only testing tool. When used, it erases any simulated firmware image before the emulator starts booting. It is a development/testing convenience and does not change real hardware behavior or fix a security problem.