Trezor firmware

This commit adds an auto-suspend feature for Trezor hardware wallets when running on battery power. It changes how the device locks and dims the screen, and refactors power-button handling. There is no clear security vulnerability in the diff itself, but the change touches sensitive lock/suspend code paths and includes a temporary default-value change (20 seconds instead of the intended 40 seconds) marked with a TODO.

This commit simply moves two small power-management files from one folder to another and updates the build scripts and import paths accordingly. The actual code behavior is unchanged. There is no security fix or vulnerability here.

This commit changes the Trezor hardware wallet's boot screen so that, on devices with a power manager, the screen dims after 30 seconds of inactivity and the device auto-locks after the configured battery autolock delay. It also makes sure these timers are cleaned up when the user finishes the boot screen. There is no direct security bug visible in the diff; it is a power-saving and lock-behavior feature.

This commit adds a new battery-specific auto-lock setting to Trezor hardware wallets. Users can now set a separate screen-lock delay for when the device is running on battery power, distinct from the existing USB-powered auto-lock delay. The change wires up the on-device menu, the settings-applier, and the Python companion library. There is no indication this fixes a security bug; it appears to be a missing feature for a new power-management capability.

This is a tiny developer-experience fix for the Trezor hardware wallet emulator (a software simulator used for testing). It stops the emulator from waiting up to 5 seconds for the Bluetooth chip to report it is ready, because the emulator has no real Bluetooth chip. There is no security issue here.

This commit changes how one device setting—the battery-powered auto-lock delay—is stored on a Trezor hardware wallet. Previously it was kept in a private/protected storage area; now it is marked as public so the PIN lock screen can read it before the user has unlocked the device. The change itself is a straightforward bug fix: the lock screen needs this value to decide when to auto-lock, but could not access it while still locked. There is no direct evidence in the commit that this introduces a security vulnerability; it mainly reduces the confidentiality of that single setting.

This is a test-only change that prevents the Trezor emulator (a software version of the hardware wallet used for testing) from entering a low-power suspend state during automated tests. It does not affect real Trezor devices and is not a security fix.

This commit adds a visual 'suspend' screen to the Trezor emulator (the desktop simulator, not the real hardware wallet). When the emulator enters suspend mode, it now shows a blue overlay with a 'SUSPENDED' image and waits for a key press or mouse click before resuming. It is a user-interface feature for the emulator only and does not change how real Trezor devices handle secrets, PINs, or cryptographic operations.

This commit adds extra debug-only log messages that describe when the Trezor device goes to sleep and what event wakes it up. These messages only appear in debug builds and do not change how the device behaves. There is no security issue visible in this change.

This commit adds a new device setting called auto_lock_delay_battery_ms to the Trezor protocol definitions. It lets users configure how long the device waits before automatically locking when running on battery or a wireless charger. The change only updates generated message bindings across Python, Rust, and core firmware; it does not contain any actual lock behavior logic or security fix.

This commit fixes a screen-repainting bug in the Trezor hardware wallet's lock/suspend feature. After the device wakes from sleep, it now fades the backlight back in and repaints the screen correctly, instead of relying on an older autodim-clear routine that could leave the display in a stale or partially drawn state. There is no direct evidence in the commit that this is a security vulnerability, but incorrect screen state after resume could in theory mislead a user about what the device is showing or asking them to confirm.

This commit is a code reorganization: it moves device locking, unlocking, homescreen selection, and suspend-related logic out of apps/base.py into a new module called apps/common/lock_manager.py. It also changes how the power button triggers suspend, using a new asynchronous notification mechanism (notify_suspend) instead of immediately locking the device. There is no direct evidence in the diff that this fixes a security vulnerability; it appears to be a feature/refactoring change.

This small change moves where the screen backlight fade happens in the Trezor hardware wallet's lock/suspend logic. Previously, the screen dimmed only inside the suspend function. Now it also dims earlier when the device decides it should suspend but is still waiting for a background task (like signing a transaction) to finish. The goal is to avoid leaving the screen bright while the user is waiting for a long operation before the device can lock. This is a user-experience and minor privacy improvement, not a fix for a serious security flaw.

This commit fixes a small inconsistency in the Trezor hardware wallet's startup screen. When a user had not set a PIN, the device's RGB LED (colored status light) was not being configured according to the user's preference. The change makes sure the LED setting is applied in that case too. There is no direct security vulnerability here; it is a user-experience and settings-consistency fix.

This commit is a user-interface feature change for the Trezor hardware wallet. It splits the single 'auto-lock delay' setting in the device menu into two separate entries: one for when the device is on battery/wireless charger and one for when it is connected to USB. There is no indication in the commit that this fixes a security bug or changes any security-critical behavior; it is purely a UI/UX update.

This commit is purely a code-style and formatting cleanup. It re-indents a large embedded image byte array, adds a missing import and two function calls related to screen dimming in the lock manager, and wraps a debug log line to fit style guidelines. There is no security-relevant change.

This commit is a minor user-interface improvement that lets text on buttons break onto a new line at colon characters, not just spaces. The stated purpose is to better display MAC addresses (which contain colons) on a connection button. There is no security relevance visible in the code or commit message.

This commit swaps in two updated binary firmware files for the Trezor T3W1 hardware wallet (a QA bootloader and a Bluetooth development binary) and updates the corresponding cryptographic hash list. The actual code inside the binaries is not shown, and there is no description of why the binaries changed. On its own, the commit does not contain any visible security bug or fix.

This commit adds a new security feature to Trezor hardware wallets that checks whether the Bluetooth chip (nRF) is running authentic, manufacturer-approved firmware before the main wallet software starts up. In production builds, if the Bluetooth chip fails this authenticity check, the device now shuts down with an error instead of continuing to boot. The change also separates the authentication code from general Bluetooth support so it can be enabled independently.

This commit adds a notification system so the Trezor device can tell the connected computer when it becomes 'unlocked' (ready to accept commands) and 'locked' (hard-locked). It also exposes a way for the device's Python code to send these notifications. There is no obvious security bug in the change itself, but the new MicroPython binding does not validate that the event number is one of the defined values, so a bug or compromised app running inside the device could pass an out-of-range value to the underlying C notification function.

This commit changes the Bluetooth low-level radio controller used in a Trezor Nordic nRF52832 board from Zephyr's open-source 'SW Split' controller to Nordic's proprietary 'SoftDevice' controller. It also removes some Bluetooth debug UART bindings and disables an alternative HCI controller node. There is no direct evidence in the commit of a security vulnerability or fix; it appears to be a routine build/configuration change.

This commit adds a standard Bluetooth 'battery service' that lets a connected phone or computer read the device's battery percentage. The feature itself is normal and not a security bug. The only small concern is that the new command accepts a battery level byte without checking the message length, but because the value is immediately passed to Zephyr's standard battery-service helper, there is no clear way to misuse it. There is no evidence this was reported as a security issue.

This is a one-line change to a GitHub Actions CI workflow. It makes the build pipeline continue even if the Nix package environment installation step times out or fails, instead of stopping the whole job. There is no indication this affects the security of the Trezor firmware, wallet keys, or user data.

This commit simply renames two on-screen menu buttons in the bootloader user interface: 'Reboot' becomes 'Restart' and 'Power off' becomes 'Turn off'. There is no change to security logic, no bug fix, and no vulnerability addressed.

This commit is a routine housekeeping change in Trezor firmware. It reserves a specific range of channel ID numbers (0xFFF0 to 0xFFFE, plus 0x0000) for future use and adjusts the random channel ID generator so it no longer picks values from that reserved range. There is no indication of a security bug being fixed.