Trezor firmware

This commit fixes a memory-protection configuration bug in the Trezor hardware wallet's secure monitor (secmon) for STM32U5 devices. The code was using the wrong linker symbol (_codelen, which measures the entire firmware) to set the size of the protected secure-monitor memory region. It now uses the correct symbol (_secmon_size, which measures only the secure monitor). The effect is that the MPU (Memory Protection Unit) guard band around the secure monitor was likely oversized or misaligned, potentially weakening isolation between the secure monitor and the rest of the firmware.

This commit only changes a version number for a Bluetooth Low Energy component from 0.1.1 to 1.0.0. There is no code change, no bug fix, and no security-related content visible in the diff or commit message.

This commit changes how a Trezor hardware wallet decides whether its battery is dangerously low and when it is safe to turn on again. Previously the device used raw battery voltage thresholds and a smoothed voltage estimate. Now it relies mainly on the fuel gauge's reported state-of-charge (SOC) percentage and whether USB power is connected. The change removes some voltage-based recovery thresholds and a smoothing variable. It is a power-management refinement, not an obvious security fix, but it could affect device availability and safe shutdown behavior.

This commit fixes a bug in the Trezor hardware wallet's power manager for STM32U5 devices. When the device resumed from a low-power state using saved 'backup memory,' it forgot whether the battery had been flagged as critically low. The fix restores that flag so the device correctly remembers a critical battery state across power events. The bug could theoretically allow a device to power on or continue operating when it should instead treat the battery as critically low, but the practical security impact is limited because other battery checks remain active.

This commit removes a safety override in the Trezor hardware wallet's power manager. Previously, when the battery was at a critically low level, the device forced the reported battery percentage (state of charge, or 'soc') to 0 before saving it to backup memory. Now it saves the actual fuel gauge reading instead. This is likely a bug fix for incorrect battery reporting, but the security implications are unclear from the diff alone.

This commit changes which Trezor firmware variant supports the 'Evolu' messages. Previously, these messages were only available in the full (non-Bitcoin-only) firmware. The patch marks them as available in the Bitcoin-only firmware instead. It is a feature-availability fix rather than a direct security patch, but misclassification of message availability could theoretically affect the attack surface of the Bitcoin-only build.

This commit changes the bootloader's battery-charging LED behavior. When the battery is fully charged, the charging LED effect now turns off instead of continuing to show a charging animation. It also adds a small helper function for the Unix emulator build so it can compile. There is no security issue visible in this change.

This commit only updates translated text strings for the Trezor hardware wallet's user interface. It adds a new message about canceling the setup of a 'wipe code' (a feature that erases the device if a specific code is entered) and updates the digital signature that verifies the translation files. There is no code that handles secrets, cryptography, device communication, or security logic being changed.

This commit fixes a user-interface labeling bug where setting up a 'wipe code' (a special code that erases the device) was incorrectly shown using the same on-screen text and flow as setting up a regular PIN. The change renames the confirmation flow, adds a flag to distinguish wipe-code setup from PIN setup, and shows wipe-code-specific cancellation text on newer Trezor layouts. It is a UI clarity fix, not a cryptographic or access-control flaw.

This commit adds a new feature that displays the version of the nRF Bluetooth chip firmware in the device's About menu. It replaces a previously hardcoded placeholder version number with a real value read from the hardware. There is no security issue visible in this change.

This commit is a routine translation update for the Trezor hardware wallet firmware. It adds and updates translated text strings for a new device model called 'Eckhart' across several language files (Czech, German, Spanish, French, Italian, Portuguese). It also updates the digital signature that verifies the translation files and refreshes the expected visual test snapshots because the on-screen text has changed. There is no code that handles secrets, cryptography, or device security logic in this change.

This update fixes a security gap in how the Trezor hardware wallet protects its most sensitive storage area. Previously, after the device 'locked' its secret memory region, that region might still have remained accessible to running code. Now the code explicitly disables all access to the secret area as soon as it is locked, making it harder for an attacker who has already broken into the device to read protected keys or data.

This commit tightens the rules for pairing a Trezor hardware wallet with its Nordic (nRF) wireless chip during factory production testing. Previously, the production-test tool could try to re-derive the pairing secret even after the device's secure secret storage was locked, which could have allowed unauthorized re-pairing or leaking of the pairing secret. Now the tool first checks whether the devices are already paired, and the secret-derivation function refuses to run if the secrets sector is locked. This is a defensive hardening fix in a manufacturing diagnostic tool, not a user-facing wallet bug.

This is a tiny UI layout fix for the Trezor hardware wallet's 'Eckhart' design. When a button with two text labels is drawn, the code now uses the absolute value of a negative horizontal offset to correctly figure out how much room the text has. Without the fix, the available width could be calculated as larger than it really is, which might cause long button labels to be split awkwardly or overflow visually. There is no direct security signal here—this is a cosmetic/layout bug fix.

This commit is a routine synchronization of translated user-interface text strings for the new 'Eckhart' Trezor device model. It adds and updates translations in Czech, German, Spanish, French, Italian, and Portuguese, plus updates translation signatures and UI test snapshot hashes. There are no code logic changes and no security relevance.

This commit tightens the order in which factory-setup commands must run for Trezor devices that use a Tropic secure chip. It prevents secrets from being initialized or the Tropic chip from being locked if earlier pairing steps were skipped or failed. The changes reduce the chance that a device leaves the factory in an inconsistent or partially-secured state, but they are defensive hardening rather than a fix for a known active attack.

This commit tightens a factory/production testing tool in Trezor firmware so that it refuses to permanently write a device variant code into one-time programmable memory unless the Tropic secure chip is already locked. Previously, the variant could be written before the chip was locked, which could let a misconfigured or tampered device pass through production with an incorrect or attacker-chosen variant setting. The change also improves the lock-check command so it can return an explicit error state instead of silently answering 'NO'.

This small change adjusts when a Trezor device shows that a 'wipe code' is set. Previously, the device menu would display the wipe-code status if the device was initialized, regardless of whether a PIN was set. After the change, the wipe-code status is only shown when both the device is initialized and a PIN is set. This is a UI/logic hardening change: it prevents a user from being misled into thinking a wipe code is active and usable when no PIN is set, because the wipe code feature depends on the PIN entry flow to trigger.

This commit is a user-interface convenience change for the Trezor hardware wallet. It lets users on the new 'Eckhart' model go back from the very first recovery-word screen to re-pick the number of words, instead of being forced to continue or cancel entirely. The code change is small and appears to be a normal UX improvement, not a security fix or vulnerability.

This commit tightens the rules between a Trezor device's PIN and its 'wipe code' (a special code that erases the device). Previously, it was possible to end up in an inconsistent state: for example, you could set a wipe code even when no PIN was set, or remove the PIN while the wipe code was still active. The patch blocks both situations and shows explanatory on-screen messages. It also replaces some internal 'assert False' statements with explicit error raises, which is a defensive cleanup. The change is a hardening fix rather than a remote exploit.

This commit updates the legal/regulatory information screen shown on a Trezor hardware wallet. It adds Japan to the list of regions, includes a new Japan icon, and adds the standard FCC compliance disclaimer text. There is no security-relevant change.

This commit is a code reorganization: it moves device locking, unlocking, homescreen selection, and suspend-related logic out of apps/base.py into a new module called apps/common/lock_manager.py. It also changes how the power button triggers suspend, using a new asynchronous notification mechanism (notify_suspend) instead of immediately locking the device. There is no direct evidence in the diff that this fixes a security vulnerability; it appears to be a feature/refactoring change.

This commit simply moves two small power-management files from one folder to another and updates the build scripts and import paths accordingly. The actual code behavior is unchanged. There is no security fix or vulnerability here.

This small change moves where the screen backlight fade happens in the Trezor hardware wallet's lock/suspend logic. Previously, the screen dimmed only inside the suspend function. Now it also dims earlier when the device decides it should suspend but is still waiting for a background task (like signing a transaction) to finish. The goal is to avoid leaving the screen bright while the user is waiting for a long operation before the device can lock. This is a user-experience and minor privacy improvement, not a fix for a serious security flaw.

This commit is purely a code-style and formatting cleanup. It re-indents a large embedded image byte array, adds a missing import and two function calls related to screen dimming in the lock manager, and wraps a debug log line to fit style guidelines. There is no security-relevant change.