fix(core): fix battery_critical flag recovering from backup memory.
What the developer wrote
Authored by kopecdav
fix(core): fix battery_critical flag recovering from backup memory.
[no changelog]
What changed, and why it matters
This commit fixes a bug in the Trezor hardware wallet's power manager for STM32U5 devices. When the device resumed from a low-power state using saved 'backup memory,' it forgot whether the battery had been flagged as critically low. The fix restores that flag so the device correctly remembers a critical battery state across power events. The bug could theoretically allow a device to power on or continue operating when it should instead treat the battery as critically low, but the practical security impact is limited because other battery checks remain active.
Treat as a low-to-moderate reliability/safety fix. Include in normal firmware release notes; no urgent security response appears necessary. If the battery_critical flag gates any security-sensitive behavior (e.g., refusing signing operations), verify those paths still enforce the condition independently.
Security signals we found
State-recovery bug in power/battery subsystem
Missing restoration of battery-critical flag from backup memory
Potential for device to resume without accurate low-battery safety state
No changelog entry despite firmware fix
Evidence from the diff
In core/embed/sys/power_manager/stm32u5/power_manager.c, pm_init() now assigns drv->battery_critical = recovery.bat_critical when inherit_state is true. Previously, the recovery structure loaded battery state from backup memory (recovery.soc, recovery.P) and passed it to the fuel gauge, but the battery_critical boolean was left at its default/reset value. This patch closes that state-recovery gap. The change is one line and marked [no changelog].
Changed components
Trezor Core firmwareSTM32U5 power managerBattery / fuel-gauge state machineInspect captured patch +1 / −0
diff --git a/core/embed/sys/power_manager/stm32u5/power_manager.c b/core/embed/sys/power_manager/stm32u5/power_manager.c
index be61749f8..51d4c73b8 100644
--- a/core/embed/sys/power_manager/stm32u5/power_manager.c
+++ b/core/embed/sys/power_manager/stm32u5/power_manager.c
@@ -128,6 +128,7 @@ pm_status_t pm_init(bool inherit_state) {
#endif
+ drv->battery_critical = recovery.bat_critical;
fuel_gauge_set_soc(&drv->fuel_gauge, recovery.soc, recovery.P);
} else {
pm_battery_initial_soc_guess();
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.