BitBox02 firmware

This commit changes a single placeholder function in the graphical simulator for the BitBox03 hardware wallet. The function, which previously would crash the simulator if called, now does nothing. The change only affects test/simulation code, not real device firmware, and there is no indication it fixes a security issue.

This commit is a build/test configuration fix for the BitBox02 graphical simulator. It enables the same cryptocurrency app features (Bitcoin, Litecoin, Ethereum, Cardano) and firmware feature in the simulator that were already available in the real device build. The change only affects the simulator's compiled feature flags and dependency lock file; it does not change any user-facing behavior or fix a security vulnerability.

This commit implements a placeholder random-number generator inside a graphical simulator for the BitBox03 hardware wallet. It replaces 'todo!' stubs with code that fills 32-byte buffers using the standard Rust 'rand' crate. The change only affects test/simulator code, not the real firmware or any production device, so it does not create a security vulnerability in shipped products. The only concern is that simulator developers must remember this is a non-cryptographic/test RNG and must not copy it into real hardware code.

This commit removes a leftover test/debug feature from the graphical simulator for the BitBox03 hardware wallet. The simulator used to automatically switch to the logo screen after 5,000 internal 'wake-up' events. That behavior was only for local testing and never affected real devices or user funds.

This commit is a routine internal code cleanup for the BitBox02/BitBox03 firmware's user interface. It moves the confirmation dialog code into its own file and introduces a small reusable helper for handling button-press results in async Rust code. There is no indication this fixes a security bug or changes user-visible security behavior.

This commit only updates the project's AGENTS.md file, which is a set of instructions for AI coding assistants. It adds a guideline telling agents not to directly use low-level FFI bindings to the LVGL UI library from feature code, and instead to use safe wrappers. No source code, firmware behavior, or security controls were changed.

This commit adds a new on-screen confirmation dialog for the BitBox03 hardware wallet and the low-level Rust-to-LVGL event-callback plumbing needed to make it work. It is a feature implementation, not a security patch. The code introduces memory-management patterns (reference-counted callbacks and a screen guard that pops the UI when a future is dropped) that are intended to make the code safer, but the commit itself does not fix any disclosed vulnerability.

This commit replaces an unimplemented placeholder ('todo!()') for a screen reset function with actual code that clears the user-interface stack. It is a normal completion of missing functionality. There is no direct evidence in the commit that this fixes an exploitable security bug, but leaving a reset operation unimplemented could previously have left stale UI state in place during sensitive workflows.

This commit simply teaches the BitBox Python library to recognize a new hardware device model, the BitBox03. It adds the model name to an internal list and tells the library how to interpret the device-info bytes sent by a BitBox03. There is no security fix or vulnerability here—just routine support for a new product variant.

This commit adds a new local simulator for the BitBox03 hardware wallet. It is purely test/development tooling: it wires up fake hardware components (fake memory, fake secure chip, fake SD card, etc.) and leaves many simulator functions as unimplemented 'todo!()' stubs. There is no indication this change affects real device firmware or introduces a security vulnerability.

This commit is a straightforward code reorganization: it moves fake/test-only implementations of hardware subsystems (EEPROM, memory, SD card, secure chip) from one internal Rust crate into a new reusable crate named bitbox-platform-host. The code itself is almost identical to what was removed, just relocated and renamed. There is no change to the real device firmware or to any security-sensitive behavior visible to users.

This commit removes an unused Rust library dependency from a graphical simulator test program. It is a routine cleanup change with no security relevance.

This commit adds a new Rust-based USB transport layer for BitBox hardware wallets. It reassembles U2F HID messages and routes vendor commands to the existing async USB task system. The change also hardens the async executor by handing out owned responses instead of copying into caller buffers, and by resetting stale state when a task is cancelled or times out. There is no vendor statement that this fixes a security bug; it reads as a feature/refactoring commit with defensive hardening.

This commit adds support for EIP-1559 Ethereum transactions in the BitBox02's payment-request (swap) feature. It lets users verify and sign Ethereum and ERC-20 token swaps that include a merchant payment request, similar to what already existed for Bitcoin. The change is a feature addition, not a fix for a known vulnerability.

This commit is a simple code cleanup: it moves two existing blocks of Ethereum fee-verification logic into new helper functions without changing what the code actually does. There is no visible security fix or behavior change.

This commit adds a new optional 'payment request' field to Ethereum EIP-1559 signing requests in the BitBox02 firmware's protocol definitions and generated code. It does not contain any actual implementation of how that field is processed, validated, or shown to the user. Based only on the code changed here, there is no identifiable security vulnerability.

This commit is a code cleanup that makes the payment-request code less Bitcoin-specific so it can be reused for other coins in the future. It does not add new user-facing features or fix a known bug. The changes move amount formatting and coin-type handling from the shared payment-request module into the Bitcoin signing code, and adjust internal test helpers. There is no indication in the commit that this fixes a security vulnerability.

This commit rewrites the firmware's USB report queue from C to Rust. It is a large refactoring that replaces a hand-written C ring buffer with a Rust VecDeque wrapped in a C-compatible FFI. The change touches the core USB communication path used by both the main hardware wallet (HWW) and U2F interfaces. There is no explicit security bug fixed or introduced in the diff, but any mistake in the boundary between C and Rust could affect how the device receives and sends USB messages.

This commit extends an existing Ethereum data-streaming feature so it also works for EIP-712 typed messages with large data fields (e.g., a 50 KB 'bytes' field). Previously, only large Ethereum transaction data could be streamed in chunks; now the same chunking is applied to typed-message values. The change also improves on-screen display of long values by warning the user when a value is too large to show in full and by showing an ellipsis. It is a feature addition with defensive input checks, not a fix for a known vulnerability.

This commit is a code reorganization: it moves SmartEEPROM handling (a flash-backed memory feature) out of the general Memory and System modules into a new dedicated Eeprom trait in the hardware abstraction layer. The same underlying functions are still called, and the unlock-attempt counter behavior is preserved. There is no obvious security bug introduced, but the change touches code that protects device reset and unlock-attempt limits, so it deserves careful review to confirm no behavior was accidentally dropped.

This commit introduces the initial hardware abstraction layer (HAL) for the BitBox03 and makes several safety improvements to the Rust bindings for the LVGL graphics library. Most changes are architectural or defensive: adding new safe wrappers, replacing borrowed C string pointers with owned copies, adding explicit unsafe markers, and removing some risky image-source APIs. There are also large additions of generated font data and placeholder TODO implementations for hardware interfaces. No obvious exploitable vulnerability is visible in the diff, but the commit is large and partially implemented, so the safety claims cannot be fully verified from this patch alone.

This commit is a pure code refactor: it moves the payment_request module from the bitcoin-specific directory up to the general API directory. The actual logic, security checks, and behavior of the payment request code are unchanged. No new vulnerabilities are introduced by this move.

This commit adds a new graphical simulator for the BitBox02 hardware wallet using the LVGL UI library. It is a large development-only change that introduces simulator code, vendored Rust dependencies, and build configuration updates. There is no indication it fixes a security bug or introduces a security vulnerability in the firmware itself.

This commit is a large revert that removes a previously added graphical simulator feature (LVGL init) from the BitBox02 firmware repository. It deletes the LVGL submodule, vendored Rust dependencies, simulator code, and related build files. There is no indication in the commit message or diff that this change fixes a security vulnerability; it appears to be a routine rollback of an unfinished or unwanted feature.

This commit is a code cleanup that moves where the device fetches a 32-byte secret key used to talk to the secure chip (Optiga). Previously, a low-level C module directly called a BB02-specific memory function. Now it goes through a Rust abstraction layer so the same module can be reused in a future BB03 device. The change does not alter how the key is stored, generated, or protected; it only reroutes the function call. There is no indication this fixes a security bug.