BitBox02 firmware

This commit adds a new optional 'payment request' field to Ethereum EIP-1559 signing requests in the BitBox02 firmware's protocol definitions and generated code. It does not contain any actual implementation of how that field is processed, validated, or shown to the user. Based only on the code changed here, there is no identifiable security vulnerability.

This commit is a code cleanup that makes the payment-request code less Bitcoin-specific so it can be reused for other coins in the future. It does not add new user-facing features or fix a known bug. The changes move amount formatting and coin-type handling from the shared payment-request module into the Bitcoin signing code, and adjust internal test helpers. There is no indication in the commit that this fixes a security vulnerability.

This commit rewrites the firmware's USB report queue from C to Rust. It is a large refactoring that replaces a hand-written C ring buffer with a Rust VecDeque wrapped in a C-compatible FFI. The change touches the core USB communication path used by both the main hardware wallet (HWW) and U2F interfaces. There is no explicit security bug fixed or introduced in the diff, but any mistake in the boundary between C and Rust could affect how the device receives and sends USB messages.

This commit extends an existing Ethereum data-streaming feature so it also works for EIP-712 typed messages with large data fields (e.g., a 50 KB 'bytes' field). Previously, only large Ethereum transaction data could be streamed in chunks; now the same chunking is applied to typed-message values. The change also improves on-screen display of long values by warning the user when a value is too large to show in full and by showing an ellipsis. It is a feature addition with defensive input checks, not a fix for a known vulnerability.

This commit introduces the initial hardware abstraction layer (HAL) for the BitBox03 and makes several safety improvements to the Rust bindings for the LVGL graphics library. Most changes are architectural or defensive: adding new safe wrappers, replacing borrowed C string pointers with owned copies, adding explicit unsafe markers, and removing some risky image-source APIs. There are also large additions of generated font data and placeholder TODO implementations for hardware interfaces. No obvious exploitable vulnerability is visible in the diff, but the commit is large and partially implemented, so the safety claims cannot be fully verified from this patch alone.

This commit is a pure code refactor: it moves the payment_request module from the bitcoin-specific directory up to the general API directory. The actual logic, security checks, and behavior of the payment request code are unchanged. No new vulnerabilities are introduced by this move.

This commit adds a new graphical simulator for the BitBox02 hardware wallet using the LVGL UI library. It is a large development-only change that introduces simulator code, vendored Rust dependencies, and build configuration updates. There is no indication it fixes a security bug or introduces a security vulnerability in the firmware itself.

This commit is a large revert that removes a previously added graphical simulator feature (LVGL init) from the BitBox02 firmware repository. It deletes the LVGL submodule, vendored Rust dependencies, simulator code, and related build files. There is no indication in the commit message or diff that this change fixes a security vulnerability; it appears to be a routine rollback of an unfinished or unwanted feature.

This commit is a code cleanup that moves where the device fetches a 32-byte secret key used to talk to the secure chip (Optiga). Previously, a low-level C module directly called a BB02-specific memory function. Now it goes through a Rust abstraction layer so the same module can be reused in a future BB03 device. The change does not alter how the key is stored, generated, or protected; it only reroutes the function call. There is no indication this fixes a security bug.

This is a build-system refactoring commit. It moves the generation of version.h and rust.h out of CMake and into a Python script and Rust build.rs, so the Rust code can be built standalone without CMake. There is no change to runtime firmware behavior, no bug fix, and no security patch visible in the diff.

This commit adds a new graphical simulator for the BitBox02 hardware wallet using the LVGL UI library. It is a large development-only change that introduces simulator code, vendored Rust dependencies, and build tooling. There is no indication from the commit title, message, or diff that this fixes or introduces any security vulnerability.

This is a small code cleanup change. It removes a local helper function that wrapped rust-bitcoin's variable-length integer serializer, and instead calls rust-bitcoin's serializer directly at each place it is used. The actual bytes produced are identical, so this does not change behavior or fix a security issue.

This commit adds support for deriving and verifying Bitcoin-family destination addresses inside payment-request memos used for coin swaps. It extends the existing Ethereum-only address-derivation feature to also cover BTC/LTC, and validates that the claimed swap destination address actually matches the derived one. There is no direct evidence this fixes an active security bug; it appears to be a feature addition that also hardens validation.

This commit is a routine code cleanup: it removes several C functions that control the Bluetooth chip and replaces their use with equivalent Rust functions. There is no indication in the commit itself that this fixes a security bug or introduces a vulnerability. It is a refactoring change.

This commit adds a new on-device user interface flow for cryptocurrency swaps, where a user can exchange Bitcoin or Litecoin for an Ethereum-like coin through a payment request. The code adds validation rules and user confirmation screens so the hardware wallet can show what is being swapped and where the received coins will go. The change is a feature addition with defensive checks, not a clear fix for an existing vulnerability.