Trezor firmware

This commit changes the text shown on the bottom home bar of a Trezor hardware wallet screen. The boot screen now says 'Unlock' instead of 'Tap to start', matching the lock screen wording. It is a cosmetic/user-interface consistency fix with no security relevance.

This commit changes build scripts so that a file providing printf-style debugging output is only included in non-production builds. It is a build-system cleanup to fix a nightly CI failure, not a security fix. There is no indication it addresses a vulnerability or changes runtime behavior of shipped devices.

This commit replaces two binary firmware files for the Trezor T3W1 hardware wallet's security monitor (secmon) with newer versions built from secmon v1.0.5. The actual code changes are not visible because the files are binary blobs. There is no claim in the commit message that this fixes a security vulnerability, and no independent references were provided. On its own, this looks like a routine component update.

This commit is a code cleanup in the Trezor firmware. It moves special error-screen functions (for wipe code, too many PIN attempts, install restricted, and device wiped) out of the runtime library (RTL) error-handling module and into a new dedicated 'rsod_special' module. It also removes the 'ensure' macro from a public header. The change is architectural refactoring; it does not appear to fix a security bug or introduce a new vulnerability. The commit message and diff give no indication this is a security patch.

This commit adds a new centralized logging system to the Trezor firmware. It is a feature/refactoring change: debug output is routed through a new 'syslog' layer with log levels and filters, and the debug console is now gated behind a compile-time flag. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a developer-facing infrastructure improvement.

This commit adds a new developer-only command, `trezorctl set-log-filter`, that lets someone with physical debug access to a Trezor device change which internal log messages are printed. It only works when the device was built with a special debug-console feature enabled, and it does not change how ordinary user operations work. There is no direct evidence in the commit that this creates a security vulnerability, but any new debug command slightly increases the attack surface available to someone who already has debug access.

This commit is a code cleanup that replaces the use of a small printf-style formatter (mini_snprintf) with simpler, purpose-built string helpers in the Trezor bootloader and low-level system code. It does not add or remove security features, and there is no direct evidence it fixes a specific vulnerability. The change may reduce the attack surface by removing format-string parsing from some paths, but it also introduces new helper functions whose correctness now matters for safety.

This is a one-line build configuration change in low-level firmware code. It swaps the condition used to decide whether to compile a special secure-mode memory check. The change appears aimed at reducing flash memory usage in board/bootloader builds, not at fixing a security vulnerability. There is no direct evidence in the commit of a security issue.

This commit replaces Trezor's small, home-grown printf-style string formatter with a more capable third-party library (eyalroz/printf). The change is described as adding 'extended formatting capabilities' and is marked with '[no changelog]'. The new library supports more format specifiers, including the %n specifier, which can write back into caller-provided memory. Trezor's configuration enables %n support. Because this is a low-level runtime component used across bootloader, firmware, kernel, secure monitor, and production-test builds, any bug in the new formatter could have broad consequences. However, the commit itself does not fix a known vulnerability, and there is no vendor statement that this change is security-relevant.

This commit changes two bootloader linker scripts for Trezor hardware wallets, reducing the alignment padding between code/data sections from 512 bytes down to 4 bytes. The stated purpose is to remove unnecessary padding and save flash space. There is no indication in the commit or supplied references that this fixes a security vulnerability.

This commit is a straightforward code cleanup: it replaces old-style printf debug messages with a new centralized logging system (LOG_ macros). It also removes some unused non-production debug hooks and switches header include guards to '#pragma once'. There is no change to security logic, cryptography, user-facing behavior, or access controls.

This commit adds a backup way for the Trezor device to check the version of the wireless nRF chip's firmware. If the normal app-to-app communication fails, the device can now ask the nRF chip's bootloader directly over a different channel. This is meant to make firmware update decisions more reliable, not to fix a known security bug. The change does not appear to introduce an obvious vulnerability, but it does add parsing of data received from the nRF chip and changes how the device decides whether to force an update.

This is a tiny one-line fix in the user-interface code of the Trezor hardware wallet. It changes a placeholder value from 0 to 1 so that a UI scrollbar helper object is never created with 'zero pages,' which would trigger an internal sanity check (a debug assertion) and crash the device in debug/test builds. In release builds the assertion is normally removed, so the practical security impact is low. There is no direct evidence this is exploitable by an attacker.

This commit fixes a minor arithmetic bug in the star-shaped loading animation on Trezor hardware wallets. When the previous code calculated the position just before the currently selected star, it could subtract 1 from 0, causing an integer underflow. In Rust, this only triggers a panic when special debug checks are enabled, so normal user devices would not crash. The fix avoids the underflow by adding the total star count before subtracting one, then wrapping with modulo. It is a UI-only change with no direct security impact on funds or device secrets.

This commit fixes how the Trezor One (legacy) hardware wallet displays Ethereum and EVM token amounts on its small screen. Previously, the numeric value and the currency symbol (like 'ETH' or a token ticker) were combined into one long string. On the device's narrow display this could cause the symbol to be cut off or hidden, making it hard for the user to know which asset they are approving. The change splits the value and the unit onto separate lines so the symbol is always visible. This is a user-interface safety improvement rather than a cryptographic bug, but it can help prevent users from accidentally approving misleading transactions.

This commit fixes a data-generation template for Trezor's older (legacy) firmware so that Ethereum network entries use the proper currency symbol and network name fields instead of incorrectly copying the network shortcut into the symbol field and leaving the name blank. It appears to be a UI/labeling correctness fix rather than a vulnerability, but the change could affect what users see when confirming Ethereum transactions on the device.

This commit adds a brand-new Rust implementation of the Trezor Host Protocol (THP), a low-level transport layer that handles packet headers, fragmentation/reassembly, checksums, sequence/ack bits, and basic message types such as ping/pong, acknowledgments, and handshakes. It is a feature commit with no changelog entry and no accompanying security disclosure. The code is purely a new library plus tests/example; it does not patch any reported vulnerability.

This commit slightly enlarges two internal memory buffers used to hold extended public keys (XPUBs) in the Trezor legacy firmware. The change gives each buffer one extra byte, likely to ensure a null terminator can always fit after a maximum-length serialized key. It is a defensive hardening change rather than a fix for a confirmed exploitable bug, and the commit message calls it a refactor with no changelog.

This commit adds a new convenience feature to the older Trezor One (legacy) firmware: when you ask the device for a public key, it now also returns a BIP-380 output descriptor string. This is a standardized way to describe how that public key should be used in Bitcoin wallets. The change is a feature addition, not a fix for a known security bug. It does not change how private keys are handled or how transactions are signed.

This change simply moves a set of helper macros from one file to a new shared header file. The macros themselves are unchanged, and no program behavior is modified. It is a routine code cleanup (refactoring) with no security relevance.

This commit adds a new 'build version' number to the information a Trezor device reports about itself when asked. It is a feature addition that exposes more version detail to host software and users. There is no indication in the commit that it fixes a security bug or introduces a vulnerability.

This commit is a straightforward code cleanup: it moves the existing firmware-validation logic out of the bootloader's main.c into a new file (fw_check.c/h) and updates the surrounding code to use the new structure. There is no change to what the bootloader actually checks or how strict it is. It is a pure refactor with no security-relevant behavior change visible in the diff.

This commit fixes several numeric overflow bugs in the older Trezor One (legacy) firmware. The most user-visible issue was a fee-rate display overflow: when a transaction used extremely large input amounts, multiplying the fee by 100 to show decimal places could wrap around to a tiny-looking fee, potentially tricking a user into approving a much higher fee than shown. The patch also prevents overflow when summing duplicate NEM mosaic quantities and stops BIP-32 child derivation once the maximum derivation depth is reached. A comment-only change notes that PINs can be up to 50 characters, but no code behavior was altered there.

This commit fixes a subtle arithmetic bug in older Trezor hardware wallets related to how a 'busy' screen timeout is calculated. The old code added a delay value to the current time and compared it directly, which could misbehave when the internal millisecond counter wraps around to zero after a long period. The new code stores the start time and duration separately and checks whether the elapsed time is still within that duration, which handles wraparound correctly. This could affect whether the device reports itself as busy, shows the right screen, or clears the busy state at the expected time.

This commit fixes a theoretical 'division by zero' bug in the progress-bar code shown on the Trezor hardware wallet during Bitcoin transaction signing. The bug could only crash the device if internal counters used to calculate progress ever became zero, which the developers describe as 'hypothetical.' It does not affect cryptographic signing itself or expose funds.