refactor(core): move fwutils to sec layer

diff --git a/core/embed/projects/prodtest/cmd/prodtest_prodtest.c b/core/embed/projects/prodtest/cmd/prodtest_prodtest.c
index 3d226be6b..bfa1cd34e 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_prodtest.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_prodtest.c
@@ -22,7 +22,7 @@
 #include <trezor_rtl.h>
 
 #include <rtl/cli.h>
-#include <util/fwutils.h>
+#include <sec/fwutils.h>
 
 #ifdef USE_BLE
 #include "prodtest_ble.h"
diff --git a/core/embed/sec/fwutils/fwutils.c b/core/embed/sec/fwutils/fwutils.c
new file mode 100644
index 000000000..e17d5a790
--- /dev/null
+++ b/core/embed/sec/fwutils/fwutils.c
@@ -0,0 +1,144 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifdef SECURE_MODE
+
+#include <trezor_bsp.h>
+#include <trezor_model.h>
+#include <trezor_rtl.h>
+
+#include <sec/fwutils.h>
+#include <sys/flash.h>
+#include <sys/systask.h>
+#include <util/image.h>
+
+#include "blake2s.h"
+
+#define FW_HASHING_CHUNK_SIZE 1024
+
+typedef struct {
+  bool initialized;
+  BLAKE2S_CTX blake;
+  uint32_t fw_offset;
+  uint32_t fw_size;
+
+} firmware_hash_context_t;
+
+static firmware_hash_context_t g_hash_context[SYSTASK_MAX_TASKS];
+
+int firmware_hash_start(const uint8_t* challenge, size_t challenge_len) {
+  firmware_hash_context_t* ctx = &g_hash_context[systask_id(systask_active())];
+
+  int err;
+
+  if (challenge_len != 0) {
+    err = blake2s_InitKey(&ctx->blake, BLAKE2S_DIGEST_LENGTH, challenge,
+                          challenge_len);
+  } else {
+    err = blake2s_Init(&ctx->blake, BLAKE2S_DIGEST_LENGTH);
+  }
+
+  if (err != 0) {
+    return -1;
+  }
+
+  ctx->fw_offset = 0;
+  ctx->fw_size = flash_area_get_size(&FIRMWARE_AREA);
+
+  ensure((ctx->fw_size % FW_HASHING_CHUNK_SIZE == 0) * sectrue,
+         "Cannot compute FW hash.");
+
+  ctx->initialized = true;
+  return 0;
+}
+
+int firmware_hash_continue(uint8_t* hash, size_t hash_len) {
+  firmware_hash_context_t* ctx = &g_hash_context[systask_id(systask_active())];
+
+  memset(hash, 0, hash_len);
+
+  if (!ctx->initialized) {
+    return -1;
+  }
+
+  int n_chunks = 128;
+
+  while (ctx->fw_offset < ctx->fw_size && n_chunks > 0) {
+    const void* chunk_ptr = flash_area_get_address(
+        &FIRMWARE_AREA, ctx->fw_offset, FW_HASHING_CHUNK_SIZE);
+
+    int err = blake2s_Update(&ctx->blake, chunk_ptr, FW_HASHING_CHUNK_SIZE);
+    if (err != 0) {
+      ctx->initialized = false;
+      return -1;
+    }
+
+    ctx->fw_offset += FW_HASHING_CHUNK_SIZE;
+    --n_chunks;
+  }
+
+  if (ctx->fw_offset >= ctx->fw_size) {
+    ctx->initialized = false;
+    int err = blake2s_Final(&ctx->blake, hash, hash_len);
+    if (err != 0) {
+      return -1;
+    }
+  }
+
+  return (100 * ctx->fw_offset) / ctx->fw_size;
+}
+
+secbool firmware_get_vendor(char* buff, size_t buff_size) {
+  const void* data = flash_area_get_address(&FIRMWARE_AREA, 0, 0);
+
+  vendor_header vhdr = {0};
+
+  memset(buff, 0, buff_size);
+
+  if (data == NULL || sectrue != read_vendor_header(data, &vhdr)) {
+    return secfalse;
+  }
+
+  if (buff_size < vhdr.vstr_len + 1) {
+    return secfalse;
+  }
+
+  memcpy(buff, vhdr.vstr, vhdr.vstr_len);
+
+  return sectrue;
+}
+
+void firmware_invalidate_header(void) {
+#ifdef STM32U5
+  // on stm32u5, we need to disable the instruction cache before erasing the
+  // firmware - otherwise, the write check will fail
+  ICACHE->CR &= ~ICACHE_CR_EN;
+#endif
+
+  // erase start of the firmware (metadata) -> invalidate FW
+  ensure(flash_unlock_write(), NULL);
+  for (int i = 0; i < (1024 / FLASH_BLOCK_SIZE); i++) {
+    flash_block_t data = {0};
+    ensure(flash_area_write_block(&FIRMWARE_AREA, i * FLASH_BLOCK_SIZE, data),
+           NULL);
+  }
+  ensure(flash_lock_write(), NULL);
+}
+
+#endif  // SECURE_MODE
diff --git a/core/embed/sec/fwutils/inc/sec/fwutils.h b/core/embed/sec/fwutils/inc/sec/fwutils.h
new file mode 100644
index 000000000..45d63eca2
--- /dev/null
+++ b/core/embed/sec/fwutils/inc/sec/fwutils.h
@@ -0,0 +1,58 @@
+/*
+ * This file is part of the Trezor project, https://trezor.io/
+ *
+ * Copyright (c) SatoshiLabs
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <trezor_types.h>
+
+// (Re)starts calculation of the firmware hash
+//
+// `challenge` is a pointer to the challenge data (optional, can be NULL).
+// `challenge_len` is the length of the challenge data (1..32).
+//
+// Return 0 on success, -1 on error.
+int firmware_hash_start(const uint8_t* challenge, size_t challenge_len);
+
+// Continues with the firmware hash calculation.
+//
+// `hash` is a pointer to a buffer where the hash will be stored.
+// `hash_len` is size of the buffer (must be at least 32).
+//
+// Return value between 0 and 100 indicates the progress of the hash
+// calculation. 100 means the hash was calculated successfully and
+// `hash` contains the hash. -1 means an error occurred during the
+int firmware_hash_continue(uint8_t* hash, size_t hash_len);
+
+// Reads the firmware vendor string from the header in the firmware area.
+//
+// `buff` is a pointer to a buffer where the vendor string will be stored.
+// `buff_size` is the length of the buffer (reserve at least 64 bytes).
+//
+// Returns `sectrue` if the vendor string was read successfully, `secfalse`
+// otherwise.
+secbool firmware_get_vendor(char* buff, size_t buff_size);
+
+#ifdef SECURE_MODE
+
+// Invalidates the firmware by erasing the first 1KB of the firmware area.
+//
+// Note: only works when write access to firmware area is enabled by MPU
+void firmware_invalidate_header(void);
+
+#endif  // SECURE_MODE
diff --git a/core/embed/sys/smcall/stm32/smcall_dispatch.c b/core/embed/sys/smcall/stm32/smcall_dispatch.c
index c971958c7..e841fa5a8 100644
--- a/core/embed/sys/smcall/stm32/smcall_dispatch.c
+++ b/core/embed/sys/smcall/stm32/smcall_dispatch.c
@@ -22,6 +22,7 @@
 #include <trezor_rtl.h>
 
 #include <sec/board_capabilities.h>
+#include <sec/fwutils.h>
 #include <sec/random_delays.h>
 #include <sec/rng_strong.h>
 #include <sec/secret.h>
@@ -31,7 +32,6 @@
 #include <sys/bootutils.h>
 #include <sys/irq.h>
 #include <sys/system.h>
-#include <util/fwutils.h>
 
 #ifdef USE_BACKUP_RAM
 #include <sec/backup_ram.h>
diff --git a/core/embed/sys/smcall/stm32/smcall_stubs.c b/core/embed/sys/smcall/stm32/smcall_stubs.c
index 74089ce43..d76352e3e 100644
--- a/core/embed/sys/smcall/stm32/smcall_stubs.c
+++ b/core/embed/sys/smcall/stm32/smcall_stubs.c
@@ -328,7 +328,7 @@ bool rng_fill_buffer_strong(void *buffer, size_t buffer_size) {
 // fwutils.h
 // =============================================================================
 
-#include <util/fwutils.h>
+#include <sec/fwutils.h>
 
 secbool firmware_get_vendor(char *buff, size_t buff_size) {
   return smcall_invoke2((uint32_t)buff, buff_size, SMCALL_FIRMWARE_GET_VENDOR);
diff --git a/core/embed/sys/smcall/stm32/smcall_verifiers.h b/core/embed/sys/smcall/stm32/smcall_verifiers.h
index 284c84535..8f05d21f2 100644
--- a/core/embed/sys/smcall/stm32/smcall_verifiers.h
+++ b/core/embed/sys/smcall/stm32/smcall_verifiers.h
@@ -115,7 +115,7 @@ void rng_fill_buffer__verified(void *buffer, size_t buffer_size);
 bool rng_fill_buffer_strong__verified(void *buffer, size_t buffer_size);
 
 // ---------------------------------------------------------------------
-#include <util/fwutils.h>
+#include <sec/fwutils.h>
 
 int firmware_hash_start__verified(const uint8_t *challenge,
                                   size_t challenge_len);
diff --git a/core/embed/sys/syscall/stm32/syscall_dispatch.c b/core/embed/sys/syscall/stm32/syscall_dispatch.c
index b62b3f3f3..30179e5fa 100644
--- a/core/embed/sys/syscall/stm32/syscall_dispatch.c
+++ b/core/embed/sys/syscall/stm32/syscall_dispatch.c
@@ -27,6 +27,7 @@
 #include <io/display.h>
 #include <io/notify.h>
 #include <io/usb.h>
+#include <sec/fwutils.h>
 #include <sec/rng_strong.h>
 #include <sec/secret.h>
 #include <sec/secret_keys.h>
@@ -37,7 +38,6 @@
 #include <sys/systask.h>
 #include <sys/system.h>
 #include <sys/systick.h>
-#include <util/fwutils.h>
 #include <util/translations.h>
 
 #ifdef USE_BLE
diff --git a/core/embed/sys/syscall/stm32/syscall_stubs.c b/core/embed/sys/syscall/stm32/syscall_stubs.c
index 4a3d7f0fc..0d2358de3 100644
--- a/core/embed/sys/syscall/stm32/syscall_stubs.c
+++ b/core/embed/sys/syscall/stm32/syscall_stubs.c
@@ -601,7 +601,7 @@ bool rng_fill_buffer_strong(void *buffer, size_t buffer_size) {
 // fwutils.h
 // =============================================================================
 
-#include <util/fwutils.h>
+#include <sec/fwutils.h>
 
 secbool firmware_get_vendor(char *buff, size_t buff_size) {
   return syscall_invoke2((uint32_t)buff, buff_size,
diff --git a/core/embed/sys/syscall/stm32/syscall_verifiers.h b/core/embed/sys/syscall/stm32/syscall_verifiers.h
index 21977c4d6..b0b39aa64 100644
--- a/core/embed/sys/syscall/stm32/syscall_verifiers.h
+++ b/core/embed/sys/syscall/stm32/syscall_verifiers.h
@@ -194,7 +194,7 @@ bool translations_write__verified(const uint8_t *data, uint32_t offset,
 const uint8_t *translations_read__verified(uint32_t *len, uint32_t offset);
 
 // ---------------------------------------------------------------------
-#include <util/fwutils.h>
+#include <sec/fwutils.h>
 
 int firmware_hash_start__verified(const uint8_t *challenge,
                                   size_t challenge_len);
diff --git a/core/embed/upymod/modtrezorutils/modtrezorutils.c b/core/embed/upymod/modtrezorutils/modtrezorutils.c
index caeb47ebe..4aa388a55 100644
--- a/core/embed/upymod/modtrezorutils/modtrezorutils.c
+++ b/core/embed/upymod/modtrezorutils/modtrezorutils.c
@@ -39,10 +39,10 @@
 
 #include <io/notify.h>
 #include <rtl/scm_revision.h>
+#include <sec/fwutils.h>
 #include <sec/secret_keys.h>
 #include <sec/unit_properties.h>
 #include <sys/bootutils.h>
-#include <util/fwutils.h>
 #include "blake2s.h"
 #include "memzero.h"
 
diff --git a/core/embed/util/fwutils/fwutils.c b/core/embed/util/fwutils/fwutils.c
deleted file mode 100644
index 5bc4df0a5..000000000
--- a/core/embed/util/fwutils/fwutils.c
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * This file is part of the Trezor project, https://trezor.io/
- *
- * Copyright (c) SatoshiLabs
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#ifdef SECURE_MODE
-
-#include <trezor_bsp.h>
-#include <trezor_model.h>
-#include <trezor_rtl.h>
-
-#include <sys/flash.h>
-#include <sys/systask.h>
-#include <util/fwutils.h>
-#include <util/image.h>
-
-#include "blake2s.h"
-
-#define FW_HASHING_CHUNK_SIZE 1024
-
-typedef struct {
-  bool initialized;
-  BLAKE2S_CTX blake;
-  uint32_t fw_offset;
-  uint32_t fw_size;
-
-} firmware_hash_context_t;
-
-static firmware_hash_context_t g_hash_context[SYSTASK_MAX_TASKS];
-
-int firmware_hash_start(const uint8_t* challenge, size_t challenge_len) {
-  firmware_hash_context_t* ctx = &g_hash_context[systask_id(systask_active())];
-
-  int err;
-
-  if (challenge_len != 0) {
-    err = blake2s_InitKey(&ctx->blake, BLAKE2S_DIGEST_LENGTH, challenge,
-                          challenge_len);
-  } else {
-    err = blake2s_Init(&ctx->blake, BLAKE2S_DIGEST_LENGTH);
-  }
-
-  if (err != 0) {
-    return -1;
-  }
-
-  ctx->fw_offset = 0;
-  ctx->fw_size = flash_area_get_size(&FIRMWARE_AREA);
-
-  ensure((ctx->fw_size % FW_HASHING_CHUNK_SIZE == 0) * sectrue,
-         "Cannot compute FW hash.");
-
-  ctx->initialized = true;
-  return 0;
-}
-
-int firmware_hash_continue(uint8_t* hash, size_t hash_len) {
-  firmware_hash_context_t* ctx = &g_hash_context[systask_id(systask_active())];
-
-  memset(hash, 0, hash_len);
-
-  if (!ctx->initialized) {
-    return -1;
-  }
-
-  int n_chunks = 128;
-
-  while (ctx->fw_offset < ctx->fw_size && n_chunks > 0) {
-    const void* chunk_ptr = flash_area_get_address(
-        &FIRMWARE_AREA, ctx->fw_offset, FW_HASHING_CHUNK_SIZE);
-
-    int err = blake2s_Update(&ctx->blake, chunk_ptr, FW_HASHING_CHUNK_SIZE);
-    if (err != 0) {
-      ctx->initialized = false;
-      return -1;
-    }
-
-    ctx->fw_offset += FW_HASHING_CHUNK_SIZE;
-    --n_chunks;
-  }
-
-  if (ctx->fw_offset >= ctx->fw_size) {
-    ctx->initialized = false;
-    int err = blake2s_Final(&ctx->blake, hash, hash_len);
-    if (err != 0) {
-      return -1;
-    }
-  }
-
-  return (100 * ctx->fw_offset) / ctx->fw_size;
-}
-
-secbool firmware_get_vendor(char* buff, size_t buff_size) {
-  const void* data = flash_area_get_address(&FIRMWARE_AREA, 0, 0);
-
-  vendor_header vhdr = {0};
-
-  memset(buff, 0, buff_size);
-
-  if (data == NULL || sectrue != read_vendor_header(data, &vhdr)) {
-    return secfalse;
-  }
-
-  if (buff_size < vhdr.vstr_len + 1) {
-    return secfalse;
-  }
-
-  memcpy(buff, vhdr.vstr, vhdr.vstr_len);
-
-  return sectrue;
-}
-
-void firmware_invalidate_header(void) {
-#ifdef STM32U5
-  // on stm32u5, we need to disable the instruction cache before erasing the
-  // firmware - otherwise, the write check will fail
-  ICACHE->CR &= ~ICACHE_CR_EN;
-#endif
-
-  // erase start of the firmware (metadata) -> invalidate FW
-  ensure(flash_unlock_write(), NULL);
-  for (int i = 0; i < (1024 / FLASH_BLOCK_SIZE); i++) {
-    flash_block_t data = {0};
-    ensure(flash_area_write_block(&FIRMWARE_AREA, i * FLASH_BLOCK_SIZE, data),
-           NULL);
-  }
-  ensure(flash_lock_write(), NULL);
-}
-
-#endif  // SECURE_MODE
diff --git a/core/embed/util/fwutils/inc/util/fwutils.h b/core/embed/util/fwutils/inc/util/fwutils.h
deleted file mode 100644
index 45d63eca2..000000000
--- a/core/embed/util/fwutils/inc/util/fwutils.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * This file is part of the Trezor project, https://trezor.io/
- *
- * Copyright (c) SatoshiLabs
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-
-#pragma once
-
-#include <trezor_types.h>
-
-// (Re)starts calculation of the firmware hash
-//
-// `challenge` is a pointer to the challenge data (optional, can be NULL).
-// `challenge_len` is the length of the challenge data (1..32).
-//
-// Return 0 on success, -1 on error.
-int firmware_hash_start(const uint8_t* challenge, size_t challenge_len);
-
-// Continues with the firmware hash calculation.
-//
-// `hash` is a pointer to a buffer where the hash will be stored.
-// `hash_len` is size of the buffer (must be at least 32).
-//
-// Return value between 0 and 100 indicates the progress of the hash
-// calculation. 100 means the hash was calculated successfully and
-// `hash` contains the hash. -1 means an error occurred during the
-int firmware_hash_continue(uint8_t* hash, size_t hash_len);
-
-// Reads the firmware vendor string from the header in the firmware area.
-//
-// `buff` is a pointer to a buffer where the vendor string will be stored.
-// `buff_size` is the length of the buffer (reserve at least 64 bytes).
-//
-// Returns `sectrue` if the vendor string was read successfully, `secfalse`
-// otherwise.
-secbool firmware_get_vendor(char* buff, size_t buff_size);
-
-#ifdef SECURE_MODE
-
-// Invalidates the firmware by erasing the first 1KB of the firmware area.
-//
-// Note: only works when write access to firmware area is enabled by MPU
-void firmware_invalidate_header(void);
-
-#endif  // SECURE_MODE
diff --git a/core/site_scons/models/stm32f4_common.py b/core/site_scons/models/stm32f4_common.py
index 1debc734b..46af4e9d3 100644
--- a/core/site_scons/models/stm32f4_common.py
+++ b/core/site_scons/models/stm32f4_common.py
@@ -13,6 +13,7 @@ def stm32f4_common_files(env, features_wanted, defines, sources, paths):
     paths += [
         "embed/io/notify/inc",
         "embed/io/tsqueue/inc",
+        "embed/sec/fwutils/inc",
         "embed/sec/monoctr/inc",
         "embed/sec/option_bytes/inc",
         "embed/sec/random_delays/inc",
@@ -36,7 +37,6 @@ def stm32f4_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/syscall/inc",
         "embed/sys/task/inc",
         "embed/sys/time/inc",
-        "embed/util/fwutils/inc",
         "vendor/micropython/lib/cmsis/inc",
         "vendor/micropython/lib/stm32lib/STM32F4xx_HAL_Driver/Inc",
         "vendor/micropython/lib/stm32lib/CMSIS/STM32F4xx/Include",
@@ -69,6 +69,7 @@ def stm32f4_common_files(env, features_wanted, defines, sources, paths):
         "embed/io/notify/notify.c",
         "embed/io/tsqueue/tsqueue.c",
         "embed/sec/board_capabilities/stm32/board_capabilities.c",
+        "embed/sec/fwutils/fwutils.c",
         "embed/sec/monoctr/stm32f4/monoctr.c",
         "embed/sec/option_bytes/stm32f4/option_bytes.c",
         "embed/sec/random_delays/stm32/random_delays.c",
@@ -107,7 +108,6 @@ def stm32f4_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/time/stm32/systick.c",
         "embed/sys/time/stm32/systimer.c",
         "embed/sys/task/sysevent.c",
-        "embed/util/fwutils/fwutils.c",
     ]
 
     if "dbg_console" in features_wanted:
diff --git a/core/site_scons/models/stm32u5_common.py b/core/site_scons/models/stm32u5_common.py
index d54c3f671..6dd026305 100644
--- a/core/site_scons/models/stm32u5_common.py
+++ b/core/site_scons/models/stm32u5_common.py
@@ -14,6 +14,7 @@ def stm32u5_common_files(env, features_wanted, defines, sources, paths):
         "embed/io/notify/inc",
         "embed/io/tsqueue/inc",
         "embed/sec/board_capabilities/inc",
+        "embed/sec/fwutils/inc",
         "embed/sec/hash_processor/inc",
         "embed/sec/monoctr/inc",
         "embed/sec/option_bytes/inc",
@@ -39,7 +40,6 @@ def stm32u5_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/task/inc",
         "embed/sys/time/inc",
         "embed/sys/trustzone/inc",
-        "embed/util/fwutils/inc",
         "vendor/stm32u5xx_hal_driver/Inc",
         "vendor/cmsis_device_u5/Include",
         "vendor/cmsis_5/CMSIS/Core/Include",
@@ -92,6 +92,7 @@ def stm32u5_common_files(env, features_wanted, defines, sources, paths):
         "embed/io/tsqueue/tsqueue.c",
         "embed/sec/board_capabilities/stm32/board_capabilities.c",
         "embed/sec/hash_processor/stm32u5/hash_processor.c",
+        "embed/sec/fwutils/fwutils.c",
         "embed/sec/monoctr/stm32u5/monoctr.c",
         "embed/sec/option_bytes/stm32u5/option_bytes.c",
         "embed/sec/random_delays/stm32/random_delays.c",
@@ -136,7 +137,6 @@ def stm32u5_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/time/stm32/systimer.c",
         "embed/sys/task/sysevent.c",
         "embed/sys/trustzone/stm32u5/trustzone.c",
-        "embed/util/fwutils/fwutils.c",
     ]
 
     if "dbg_console" in features_wanted:
diff --git a/core/site_scons/models/unix_common.py b/core/site_scons/models/unix_common.py
index bed1fa5cf..755558ccb 100644
--- a/core/site_scons/models/unix_common.py
+++ b/core/site_scons/models/unix_common.py
@@ -12,6 +12,7 @@ def unix_common_files(env, features_wanted, defines, sources, paths):
     paths += [
         "embed/io/notify/inc",
         "embed/io/display/inc",
+        "embed/sec/fwutils/inc",
         "embed/sec/random_delays/inc",
         "embed/sec/time_estimate/inc",
         "embed/sys/bsp/inc",
@@ -29,7 +30,6 @@ def unix_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/startup/inc",
         "embed/sys/task/inc",
         "embed/sys/time/inc",
-        "embed/util/fwutils/inc",
     ]
 
     sources += [
@@ -37,6 +37,7 @@ def unix_common_files(env, features_wanted, defines, sources, paths):
         "embed/io/notify/notify.c",
         "embed/io/usb/unix/sock.c",
         "embed/sec/board_capabilities/unix/board_capabilities.c",
+        "embed/sec/fwutils/fwutils.c",
         "embed/sec/random_delays/unix/random_delays.c",
         "embed/sec/secret/unix/secret.c",
         "embed/sec/secret/unix/secret_keys.c",
@@ -58,7 +59,6 @@ def unix_common_files(env, features_wanted, defines, sources, paths):
         "embed/sys/task/unix/systask.c",
         "embed/sys/time/unix/systick.c",
         "embed/sys/time/unix/systimer.c",
-        "embed/util/fwutils/fwutils.c",
     ]
 
     if "usb" in features_wanted: