Trezor firmware

This commit changes how the Trezor hardware wallet uses a special secure-chip feature called 'mac-and-destroy' slots during PIN verification. Previously, the same small set of slots was used every time the PIN was set or checked. Over many PIN changes, repeatedly erasing and rewriting those same slots could physically wear out that part of the secure chip. The patch spreads the wear across 64 slots by rotating which slot is used based on how many times the PIN has been changed. This is a reliability and physical-security improvement, not a fix for an obvious remote attack. There is no claim in the commit that this resolves a known security bug or reported vulnerability.

This commit is a small internal refactor of the Trezor firmware's Tropic secure-element integration. It adds a software cache for a hardware-backed 'change PIN counter' so the firmware does not have to repeatedly ask the secure chip for the same value during PIN operations. There is no indication in the commit or title that this fixes a security bug; it appears to be a performance or timing-predictability improvement.

This commit is a code cleanup: it moves the initialization of the HSI (High-Speed Internal) clock from the RGB LED driver into the system startup code. The change removes a duplicate HSI startup block and stops the system from turning HSI off after switching to the external HSE clock. There is no indication this is a security fix or introduces a security vulnerability.

This commit hardens the security boundaries inside Trezor's STM32U5 microcontroller. It moves USB power initialization into the trusted secure monitor, restricts access to sensitive system registers (power, clock, cache, watchdog, RAM config), and locks down the TrustZone configuration so it cannot be changed later. These are defensive improvements that reduce the attack surface if untrusted code runs on the device, but the commit itself does not fix a known exploitable bug.

This commit changes the order in which a Trezor hardware wallet resumes internal components after waking from a low-power suspend state. Previously, secure drivers were resumed after the Optiga security chip was resumed. The fix moves secure-driver resumption before Optiga resumption. The commit title says this fixes a problem that occurs when the Optiga chip is properly paired and the bootloader is locked. Without more context, the exact security impact is unclear, but an incorrect resume order could in principle cause a secure-driver failure or leave a security-critical component in an inconsistent state during wake-up.

This commit only updates the release date text in two changelog files, changing 'internal release' to '28th November 2025'. It does not modify any code, firmware logic, or security behavior. There is no security issue present.

This commit updates a pre-built binary file used only in developer builds of the Trezor T3W1 hardware wallet's secure monitor, and adds a one-line comment explaining how that developer binary is built. There is no indication this affects production firmware or fixes a security vulnerability. It appears to be a routine development-only maintenance change.

This commit is just a documentation update: it adds a changelog note saying that firmware version 2.9.5 fixes a bug where the device's tamper-detection red screen of death (RSOD) was not appearing. The actual code fix is not shown in this commit, so we can only judge the issue from the one-line changelog entry. If the RSOD really failed to display when a tamper event happened, a local attacker who opened or probed the device might not trigger the expected warning, potentially hiding physical tampering. However, this commit itself changes no code, so its direct security risk is low and the severity depends entirely on the unseen fix.

This commit simply adds a new firmware version number (2.9.5) for one Trezor device model (T3W1) to a release-tracking JSON file. It is an administrative metadata update with no code changes and no apparent security relevance.

This commit replaces a binary firmware component called 'secmon.bin' for the T3W1 hardware model. The change is a binary blob update with no source code diff, no changelog entry, and no description of what changed inside the file. There is not enough public information to determine whether this is a security fix, a routine update, or something else.

This commit adds a new cryptographic signature entry to a JSON file that records approved translations for the Trezor hardware wallet firmware. The signature verifies that the translation data for version 2.9.5.0 is authentic and has not been tampered with. There is no code change and no direct security vulnerability visible in the diff itself.

This commit adjusts the default screen brightness for the Trezor T3W1 model during production testing. It changes one number in a factory test program from 85 to 155, matching other models. There is no security issue visible in this change.

This commit changes the Trezor firmware emulator's fake Bluetooth driver so it starts in an 'enabled' state by default. It only affects the Unix emulator build used for software testing, not real Trezor hardware. The change moves socket setup from the 'start' routine to the 'init' routine and adds a new flag tracking whether communication is running. There is no direct evidence this fixes a security vulnerability; it appears to be an emulator behavior or test-fix change.

This commit is a routine housekeeping change that only updates version numbers from 2.9.6 to 2.9.7 for the main firmware and from 1.0.5 to 1.0.6 for the security monitor, plus refreshes translation file metadata and their cryptographic signature. There are no code behavior changes, no bug fixes, and no security-related modifications visible in the diff.

This is a small build-script change for the Trezor hardware wallet firmware. It changes the CI build so that only the final firmware/bootloader files are copied out of the Docker container, instead of the entire build folder. The stated reason is to fix a CI failure, not to fix a security bug. There is no direct evidence in the commit that this is a security fix.

This commit only reduces the amount of text printed during a Docker build script. It adds quieter download flags for wget/curl and removes the terminal allocation flag from the Docker run command. There is no security-relevant change.

This is a minor build-script change that adds the secure-monitor (secmon) component to the list of firmware artifacts whose fingerprints are collected during CI. It also switches the file-existence check from `-f` to `-s` so that empty placeholder files are skipped. There is no user-facing or security-relevant code change.

This commit adds a new command-line option (-w) to the Trezor bootloader emulator, a software-only testing tool. When used, it erases any simulated firmware image before the emulator starts booting. It is a development/testing convenience and does not change real hardware behavior or fix a security problem.

This commit adds a build-time and emulator option to turn off visual animations in the bootloader. It is a routine developer convenience change and does not fix, introduce, or change any security behavior.

This commit adds a new command-line option to the Trezor bootloader emulator that lets developers pre-load a firmware image into the emulated flash memory before running tests. It is a development/testing convenience feature and does not change the real hardware bootloader or wallet behavior.

This commit adds a new build option, DISABLE_TROPIC, that lets developers compile Trezor firmware test builds without the Tropic secure-element feature. It mirrors the existing DISABLE_OPTIGA flag and is blocked from production builds. There is no indication this is a security fix or vulnerability patch; it is a build-system convenience for hardware testing.

This is a one-line bug fix in the Trezor hardware wallet's power manager for STM32U5 chips. When the device timed out while waiting for its power state to stabilize, the function was accidentally returning the wrong value (false) instead of the proper error code (PM_TIMEOUT). This could cause callers to misinterpret a timeout as success, potentially mishandling power-state transitions. It is a correctness fix rather than an obvious exploit, but in embedded firmware such misreporting can contribute to reliability or security issues.

This commit adds a new function that explicitly turns off an external physical tamper-detection input on Trezor's secure microcontroller after initialization. Previously, the tamper input may have been left enabled by default after tamper_init(), which could allow a physical attacker to trigger a tamper event (and potentially wipe secrets or reset the device) using an external signal. The fix ensures the external trigger is disabled unless later explicitly enabled.

This is a build-system fix that moves a single function outside of a conditional compilation block. When the Optiga secure chip support was disabled (DISABLE_OPTIGA=1), the T3W1 hardware build failed because a function named secret_key_delegated_identity was accidentally placed inside the Optiga-only code section. The patch makes that function always available, which is correct because it is unrelated to Optiga. There is no security vulnerability here.

This commit is a routine synchronization of translated user-interface text strings from the Crowdin translation platform. It updates wording in Czech, German, Spanish, French, and Portuguese translation files, refreshes the cryptographic signature that authenticates those translations, and updates the corresponding visual test snapshots. There are no code logic changes, no security fixes, and no behavior changes beyond the exact text shown on screen.