Trezor firmware

This commit is a test-infrastructure change only. It adds a way for automated tests to read the account name shown on a FIDO security-key confirmation screen, and renames some existing test helper methods from 'tt_' to 'bolt_' to better match the current product naming. There is no change to how user data is handled, no fix for a bug, and no security-related behavior change.

This commit is a visual layout fix for the Trezor T3W1 hardware wallet bootloader. It adjusts where the 'waiting for host' text appears on screen when no menu header is shown. There is no security-relevant change.

This is a simple code cleanup change that renames a parameter from 'auto_update' to 'show_menu' across several files. The functionality remains exactly the same; only the variable name has been changed to better describe what it actually controls (whether a menu button is shown on the bootloader connection screen). There is no security impact.

This commit is a pure code reorganization: it moves the board_capabilities module from the util directory to the sec directory and updates all include paths and build files accordingly. No functionality, logic, or security behavior changes. It is a refactoring with no user-visible or security-relevant effect.

This commit is a routine internal code cleanup. It moves the logging header file from one directory to another and splits out a system-exit declaration to remove circular dependencies between two low-level software layers. No security vulnerability is introduced or fixed; the functionality of the code remains the same.

This commit is a pure code reorganization: it moves the unit_properties module from the util directory to the sec (security) directory and updates all include paths and build files accordingly. The actual logic for reading device properties from one-time-programmable memory, serial numbers, and SD hotswap settings is copied unchanged. There is no functional change and no security fix or vulnerability introduced.

This commit is a pure code reorganization: it moves the backup RAM driver from the 'sys' directory to the 'sec' directory and updates all include paths accordingly. The actual C source code for the driver is identical before and after the move. There is no functional change, no bug fix, and no security patch visible in the diff.

This commit is a pure code reorganization: it moves the graphics (gfx) subsystem from the `embed/gfx/` directory into `embed/io/gfx/`, updates all build scripts and include paths accordingly, and renames some internal subdirectories (for example, `fonts/` becomes `terminal/`). The actual graphics logic, functions, and behavior appear unchanged. There is no indication this fixes or introduces a security issue.

This commit is a code reorganization: it splits the random-number generator (RNG) module into two parts. The basic hardware RNG moves from the security subsystem to the system subsystem, while the stronger multi-source RNG stays in the security subsystem under a new name. All call sites are updated to include the correct new header. The actual logic of how random numbers are generated does not change.

This commit is a pure code reorganization: it moves the 'translations' module from one directory location to another without changing what the code does. The functions that read, write, and erase translation data in device flash remain identical. There is no visible security bug or fix in the change.

This commit is a pure code reorganization: it moves the flash memory driver files from one directory (embed/util/flash) to another (embed/sys/flash) and updates all include paths and build scripts accordingly. The actual flash programming, erasing, and one-time-programmable (OTP) logic is copied verbatim, with no functional changes. There is no indication this fixes or introduces a security vulnerability.

This commit is a simple internal code reorganization: it moves the source-code-management revision identifier (a build-time constant that records which Git commit the firmware was built from) from one internal directory to another. No behavior changes, no security fixes, and no new vulnerabilities are visible in the diff.

This commit is a pure code reorganization: it moves the 'notify' module from one directory to another and updates all references. No functionality was changed, no bugs were fixed, and no security behavior was altered.

This commit is a large but straightforward code reorganization: it moves the firmware image handling module from a general utility directory (embed/util/image) into a security-focused directory (embed/sec/image) and updates all include paths and build scripts accordingly. The actual code logic appears unchanged except for the path/namespace adjustments. There is no indication this fixes or introduces a security vulnerability.

This commit is a pure code reorganization (refactor) that moves the 'Red Screen of Death' (RSOD) error-display code from one directory to another and updates the build files and #include paths accordingly. No security vulnerability is introduced or fixed; the visible behavior of the device is unchanged.

This commit is a large code refactor that moves the power management subsystem from one internal directory (`sys`) to another (`io`) in the Trezor firmware. It renames include paths, reorganizes files, and adds new battery fuel-gauge and PMIC driver code, but the commit message explicitly labels it as a refactor with '[no changelog]'. There is no indication of a security fix or vulnerability being addressed.

This commit is a pure code reorganization: it moves the tamper-detection driver files from one directory (sys) to another (sec) and updates all include paths accordingly. The actual tamper-detection logic is unchanged, so this does not fix or introduce a security vulnerability on its own.

This commit only changes test code for the Trezor hardware wallet. It refactors how tests compute expected cryptographic values so they can run on real hardware devices instead of only on emulators, and moves certificate-verification helper code into a shared test utility. There is no change to the actual firmware or wallet behavior, and no security vulnerability is introduced or fixed.

This commit adds a new internal telemetry feature to the Trezor firmware that records the minimum and maximum battery temperature in a small, protected memory area (backup RAM). It only stores a float value for the coldest and hottest battery readings and does not send data anywhere. There is no obvious security bug in the code, but it is a new subsystem that touches low-level firmware components and could become relevant if future changes connect it to untrusted inputs or expose it externally.

This commit adds downgrade protection for the Secure Monitor (secmon), a small privileged security component that runs alongside the main firmware on Trezor hardware wallets. Previously, only the bootloader and firmware had downgrade protection via monotonic counters stored in secure flash. This change reserves a third monotonic counter, records the secmon version in the image header, and makes the bootloader reject older or rolled-back secmon images during firmware updates and boot. It is a defensive hardening feature, not a fix for an active vulnerability, and the initial secmon monotonic version starts at 0 so existing images remain compatible.

This commit simply increases three internal version counters for the Trezor T3W1 hardware wallet from 1 to 2 (or 0 to 1). These counters are used to prevent downgrading to older, potentially less secure firmware, bootloader, or security monitor software. The change itself does not fix a bug or add a feature; it is a routine housekeeping step to keep downgrade protection working after a release. There is no direct security vulnerability shown in the diff.

This commit adds support for signing TRON smart-contract calls (like USDT/USDD transfers) on Trezor hardware wallets. Because the device cannot yet decode the actual token-transfer details, users are shown only the smart-contract address and raw data, meaning they are 'blind signing' the transaction. The commit message explicitly calls this out. There is also a fee-limit check to cap how much TRX can be burned, and a fix changing some timestamp/expiration fields from signed to unsigned integers.

This commit adds a new optional 'back button' to a Trezor screen type called confirm_value. It is a user-interface feature for the upcoming Eckhart hardware model and does not fix or introduce any security vulnerability. The change simply lets callers request a back arrow instead of a cancel cross, and wires that through the Rust UI layer for all supported device layouts.

This commit removes a dedicated two-page 'confirm output with amount' screen and replaces it with two separate confirmation prompts for the address and the amount. It is a user-interface refactor, not a fix for a security vulnerability. The change does not introduce obvious security flaws, but it slightly alters how users review transaction details on newer Trezor layouts.

This commit is a routine user-interface feature addition. It lets certain 'property' display screens show an optional subtitle and gives callers a way to override the page title. There is no security-relevant change in the diff.