Trezor firmware

This commit is a pure code reorganization: it moves the board_capabilities module from the util directory to the sec directory and updates all include paths and build files accordingly. No functionality, logic, or security behavior changes. It is a refactoring with no user-visible or security-relevant effect.

This commit is a pure code reorganization: it moves the 'notify' module from one directory to another and updates all references. No functionality was changed, no bugs were fixed, and no security behavior was altered.

This commit is a routine internal code cleanup. It moves the logging header file from one directory to another and splits out a system-exit declaration to remove circular dependencies between two low-level software layers. No security vulnerability is introduced or fixed; the functionality of the code remains the same.

This commit is a simple internal code reorganization: it moves the source-code-management revision identifier (a build-time constant that records which Git commit the firmware was built from) from one internal directory to another. No behavior changes, no security fixes, and no new vulnerabilities are visible in the diff.

This commit is a pure code reorganization: it moves the flash memory driver files from one directory (embed/util/flash) to another (embed/sys/flash) and updates all include paths and build scripts accordingly. The actual flash programming, erasing, and one-time-programmable (OTP) logic is copied verbatim, with no functional changes. There is no indication this fixes or introduces a security vulnerability.

This commit is a pure code reorganization: it moves the 'translations' module from one directory location to another without changing what the code does. The functions that read, write, and erase translation data in device flash remain identical. There is no visible security bug or fix in the change.

This commit is a pure code reorganization: it moves the graphics (gfx) subsystem from the `embed/gfx/` directory into `embed/io/gfx/`, updates all build scripts and include paths accordingly, and renames some internal subdirectories (for example, `fonts/` becomes `terminal/`). The actual graphics logic, functions, and behavior appear unchanged. There is no indication this fixes or introduces a security issue.

This commit is a pure code reorganization: it moves the backup RAM driver from the 'sys' directory to the 'sec' directory and updates all include paths accordingly. The actual C source code for the driver is identical before and after the move. There is no functional change, no bug fix, and no security patch visible in the diff.

This commit is a code reorganization: it splits the random-number generator (RNG) module into two parts. The basic hardware RNG moves from the security subsystem to the system subsystem, while the stronger multi-source RNG stays in the security subsystem under a new name. All call sites are updated to include the correct new header. The actual logic of how random numbers are generated does not change.

This commit is a code reorganization: it moves the small telemetry module that records battery temperature from one internal directory to another. The actual logic for reading, writing, and validating the temperature data is unchanged. There is no indication this fixes a security bug or introduces a new vulnerability.

This commit is a code reorganization (refactor) that moves the suspend/resume functionality from one part of the codebase to another. It splits the suspend module into an I/O layer and a security layer, updates include paths, and adjusts build configuration files. There is no indication of a security fix or vulnerability being addressed.

This commit is a straightforward internal code reorganization: it moves the hardware revision detection module from a general utility folder into the security (sec) layer. The actual logic for reading the hardware revision from GPIO pins is unchanged. There is no user-facing behavior change and no indication of a security fix or vulnerability.

This commit is a pure code reorganization: it moves the I2C bus driver files from one directory (io/i2c_bus) to another (sys/i2c_bus) and updates all include paths accordingly. No functionality, logic, or behavior of the firmware was changed. It is a housekeeping refactor with no user-visible or security-relevant effect.

This commit removes code that turned off the screen backlight when a power-voltage drop (PVD) interrupt fired. The change is described as a simple internal cleanup ('refactor') with no changelog entry. It is not clearly a security fix, but removing a safety behavior during a low-power event could have minor security or reliability implications if the backlight was meant to blank the screen before shutdown.

This commit is a pure code reorganization: it moves a small queue utility (tsqueue) from one internal directory to another and updates the include paths in the files that use it. No functionality was changed, no bugs were fixed, and no security behavior was altered.

This is a code cleanup change that removes circular dependencies between low-level system modules and image-handling utilities. It replaces a few shared macro definitions with local equivalents and adds compile-time checks to ensure the duplicated constants stay in sync. There is no indication this fixes a security bug or changes device behavior in a security-relevant way.

This commit is a pure code reorganization: it moves the 'option_bytes' source files from the general utility directory into the security (sec) layer and updates the include paths and build files accordingly. The actual logic for reading and writing the microcontroller's flash option bytes is unchanged. There is no visible security bug introduced by this change.

This commit is a pure code reorganization: it moves the CPU-ID reading module from a 'util' directory to a 'sys' directory, updating include paths and build lists accordingly. The actual logic for reading the chip's unique identifier is unchanged, and there is no visible security fix or behavior change.

This commit is a pure code reorganization: it moves the firmware utility code (used for hashing firmware, reading vendor info, and invalidating firmware headers) from a general utilities directory into a security-focused directory. The actual code logic is unchanged, and there is no indication this fixes or introduces a security vulnerability.

This commit removes unused Apple macOS framework dependencies from the project's Nix shell environment file. It is a routine cleanup with no apparent security relevance.

This commit adds battery safety monitoring to Trezor hardware wallets. It detects problems like a disconnected temperature sensor (NTC), charging that is stuck at a low current, and sudden jumps in battery temperature or voltage. When such a problem is detected during production testing, the device shows a red error screen and disables charging. The change is defensive: it is meant to prevent unsafe charging conditions rather than introduce a security flaw.

This commit only updates expected screenshot fingerprints (called UI fixtures) used by automated tests. It does not change any firmware, application, or wallet code that runs on a real Trezor device. There is no user-facing or security-relevant change in this commit itself.

This commit only changes test code for the Trezor hardware wallet. It refactors how tests compute expected cryptographic values so they can run on real hardware devices instead of only on emulators, and moves certificate-verification helper code into a shared test utility. There is no change to the actual firmware or wallet behavior, and no security vulnerability is introduced or fixed.

This commit adds downgrade protection for the Secure Monitor (secmon), a small privileged security component that runs alongside the main firmware on Trezor hardware wallets. Previously, only the bootloader and firmware had downgrade protection via monotonic counters stored in secure flash. This change reserves a third monotonic counter, records the secmon version in the image header, and makes the bootloader reject older or rolled-back secmon images during firmware updates and boot. It is a defensive hardening feature, not a fix for an active vulnerability, and the initial secmon monotonic version starts at 0 so existing images remain compatible.

This commit adds a new internal telemetry feature to the Trezor firmware that records the minimum and maximum battery temperature in a small, protected memory area (backup RAM). It only stores a float value for the coldest and hottest battery readings and does not send data anywhere. There is no obvious security bug in the code, but it is a new subsystem that touches low-level firmware components and could become relevant if future changes connect it to untrusted inputs or expose it externally.