BitBox02 firmware

Enable scope C LTO for firmware

Enable scoped GCC LTO for firmware C code to reduce ROM size while preserving section GC and stack protector support. Build firmware C objects plus the optiga and cryptoauthlib static libraries with -flto -ffat-lto-objects, and link only firmware images with -flto, since useful size savings require LTO IR in the linked static libraries.

Switch the ARM toolchain to the LTO-aware archive utilities (arm-none-eabi-gcc-ar, arm-none-eabi-gcc-nm, arm-none-eabi-gcc-ranlib); plain ar/ranlib can archive LTO objects without the plugin and produce invalid tiny images by failing to extract live objects.

Keep bootloaders, factory-setup, ASF4, samd51a-ds, and embedded-swd
off the LTO path because startup, interrupt, MMIO, vector-table,
linker-script, assembly, callback-table, and section-name interactions
are not cheaply auditable for LTO safety. Mark local stack protector
symbols as kept/visible so late LTO-generated references to
__stack_chk_fail and __stack_chk_guard are retained;
no_stack_protector is intentionally not needed.

da14531: restore BLE UART backpressure

ListBackups returns one protobuf containing all SD card backups. With many backups, the response spans many 64-byte HWW/U2FHID reports. USB sends those reports directly over HID, but BLE first serial-frames each report for the DA14531 and queues the escaped bytes in the fixed-size UART ByteQueue.

The Rust ByteQueue port kept the panicking single-byte put() API and the BLE poller used it for every framed byte. That removed the previous v9.25 backpressure behavior: da14531_protocol_poll() consumed the pending HWW report before knowing whether the whole framed BLE packet fit in the 2048-byte UART queue. If ListBackups produced data faster than UART drained it, put() eventually hit capacity and panicked with bytequeue overflow. USB does not use this UART queue, which is why the same request worked there.

Add ByteQueue::try_put_slice() plus an extern C wrapper that takes util::Bytes and performs an all-or-nothing enqueue. The BLE HWW path now formats the 64-byte report into a temporary serial frame and only clears hww_data after try_put_slice() succeeds. If the queue is full, it returns without writing any bytes, preserving frame boundaries and leaving the same report pending for the next poll after UART has drained.

Keep the existing panicking put() behavior for the other bytequeue callers so the change stays scoped to the actual backpressure boundary. The separate Rust and extern-wrapper tests cover successful writes and failed overflow attempts being atomic.

Shrink secp256k1 callbacks

Override libsecp256k1's default callbacks with tiny local stubs.

The vendored callbacks print an error and then call abort(). In the
firmware image those failure-only paths pull in a large chunk of newlib
stdio and signal handling even though the callbacks are only used for
fatal illegal-argument and internal-consistency failures and must never
return.

Saved: 2672 bytes

The final linked image drops the abort/stdio path retained only by those
callbacks, including the public symbols abort, raise, _raise_r,
_kill_r, _getpid_r, fprintf, printf, and _vfprintf_r. It also drops the
private stdio helpers behind them, such as __sfputc_r, __sfputs_r,
__swsetup_r, __swbuf_r, _fflush_r, _fwalk_sglue, __swhatbuf_r,
__swrite, __sread, __sseek, __sclose, __sinit, and __smakebuf_r.
Meanwhile secp256k1_default_illegal_callback_fn and
secp256k1_default_error_callback_fn shrink from 28 bytes each to 2
bytes each.

This keeps the relevant behavior intact: both callbacks still trap the
firmware in a non-returning fatal path, but without dragging in unused
diagnostic formatting code.

securechip: port attestation sign

securechip: make random async

assert 9.26.1

Format generated protobufs explicitly

Run rustfmt from the explicit protobuf regeneration script and include
the generated Rust files in check-style.

This keeps firmware builds working by avoiding formatting inside the
generator/build path while making the manual regen workflow produce
style-clean committed outputs.

Move protobuf bindings into bitbox-proto

Add a committed bitbox-proto crate for the generated Rust protobuf
bindings.

Switch regeneration to a Cargo-driven flow, add a make shortcut and CI
drift check, and keep the generator copy-on-change so no-op regen runs
do not churn timestamps or invalidate build caches.

securechip: port password ops

Move the OPTIGA password flows into Rust in one step, including the async command wrappers and the migrated unit tests. This keeps the commit focused on the securechip password migration itself; the unrelated Box::pin(...) call-site changes were split into a separate commit.

util/sha2: fix safety docs syntax

securechip: change output type of password stretch to [u8; 32]

Encode size in type for clarity.

ui: don't show waiting screen during password stretch

Before the securechip operations became async, the UI did not process
during keystore unlock and froze at the last screen of the password
confirmation, and UI continued with the BIP39 unlock animation.

Now that they are async, the password screen is popped and the waiting
screen would be shown for roughly 1s before the unlock animation
started. To improve UI there, we start showing first screen of the
unlock animation (the locked lock) as the filler screen.

Instead of the default waiting screen being shown, during these
operations the first animation frame component is shown and held, with
animation starting only in bip39_unlock.

The downside is that when entering the wrong password, it is also
briefly shown before the wrong-password error message, but it's
acceptable.

There are other workflows where the waiting screen is also shown
during the stretch, not addresed by this commit: show mnemonic, create
backup, and change password (any call to
`workflows::unlock::unlock_keystore()` to check the password).

Co-Authored-By: Niklas Dusenlund <niklas.dusenlund@bitbox.swiss>

simulator-graphical: fix factory_randomness

Same as cee5bdb3ba06f60b93213f9c2a183a7683fe1551, but for BB02
graphical simulator.

releases: add v9.26.1

simulator: fix factory_randomness

The C simulator still uses the BitBox02 Hal. The newly introduced
factory_randomness method there dereferenced the same static address
as on the device, leading to a segfault.

securechip: make kdf async

Expose the OPTIGA crypt instance to Rust and route the\nKDF through the async command bridge. The higher-level\nsecurechip and application callers now await the operation\ninstead of relying on the synchronous C wrapper.

bitbox-core-utils: make salt::hash_data return 32 bytes

For better clarity and to remove needless try_into().unwrap().

rust: rename bitbox02-noise -> bitbox-noise

Use HAL random for noise key generation

bitbox02-rust should not depend on bitbox02-specific random types just
to initialize the Noise responder state. Move Noise key generation
onto bitbox_hal::Random and let bitbox02-noise initialize the
responder handshake from HAL-provided randomness.

This removes the old Random32/BB02Random32 plumbing. That trait
existed only because the handshake state was generic over a DH type
whose genkey() path generated the responder ephemeral internally. Once
the responder ephemeral is treated as explicit init input instead, the
state no longer needs a device-specific RNG type parameter. In the
final API, init() takes a HAL random source and derives that ephemeral
key there, which keeps the dependency boundary at bitbox-hal while
preserving the same handshake flow.

add new bitbox-core-utils workspace crate

Move the salt and random helpers out of bitbox02-rust into a
new workspace crate that depends on bitbox-hal.
Add bitbox-platform-host as a dev-dependency there so the same
unit tests can run against the host fakes, and update the
bitbox02-rust and bitbox02-rust-c consumers to use the new
crate.

hal: move TestingRandom to platform host

hal: add random, factory_randomness, drop random_32_bytes

bitbox02: fix native cargo test

```
cd src/rust/bitbox02 && cargo test --all-features -- --test-threads 1
```

Failed because of a missing hex_lit feature.

eth: harmonize large data warnings for transactions and typed messages

Adjust wording in transaction signing so warnings and truncating logic
match the newly implemented approach in sign_typed_msg.rs

Co-Authored-By: Marko Bencun <marko@shiftcrypto.ch>

rust: async unit tests instead of block_on

Easier to read/write the unit tests.