What the developer wrote
Authored by cedwies
HAL: add reboot_to_bootloader()
What changed, and why it matters
This commit is a straightforward internal refactoring: it moves the device-reboot-into-bootloader function behind a new 'System' hardware-abstraction trait so the rest of the Rust code calls it through a generic interface rather than directly. The actual reboot behavior, safety checks (a user confirmation screen), and underlying C function are unchanged. There is no new vulnerability here; it is normal code cleanup.
No security action required. Treat as normal maintainability refactoring. If reviewing further, verify that the `System` trait is only implemented by trusted HAL code and that the reboot API continues to require user confirmation.
Security signals we found
Refactoring only: no change to reboot preconditions or user confirmation flow
Reboot capability remains behind existing authenticated HWW API and user confirmation
No new unsafe code introduced; one existing unsafe call is unchanged
No mention of security fix, CVE, or bug in commit message
Evidence from the diff
The change introduces a System trait with reboot_to_bootloader() and wires it into the existing Hal trait and its BitBox02Hal / TestingHal implementations. The system.rs API handler now calls hal.system().reboot_to_bootloader() instead of bitbox02::reboot_to_bootloader(). The bitbox02::reboot_to_bootloader() wrapper is simplified by removing the #[cfg(testing)] panic variant and adding an empty loop after the unsafe C call. The user-confirmation workflow preceding the reboot remains intact.
Changed components
src/rust/bitbox02-rust/src/hal.rssrc/rust/bitbox02-rust/src/hww/api/system.rssrc/rust/bitbox02/src/lib.rsInspect captured patch +40 / −8
diff --git a/src/rust/bitbox02-rust/src/hal.rs b/src/rust/bitbox02-rust/src/hal.rs
index 694fe3d..7ebce40 100644
--- a/src/rust/bitbox02-rust/src/hal.rs
+++ b/src/rust/bitbox02-rust/src/hal.rs
@@ -93,6 +93,10 @@ pub trait Memory {
fn multisig_get_by_hash(&self, hash: &[u8; 32]) -> Option<String>;
}
+pub trait System {
+ fn reboot_to_bootloader(&mut self) -> !;
+}
+
/// Hardware abstraction layer for BitBox devices.
pub trait Hal {
fn ui(&mut self) -> &mut impl Ui;
@@ -100,6 +104,7 @@ pub trait Hal {
fn random(&mut self) -> &mut impl Random;
fn securechip(&mut self) -> &mut impl SecureChip;
fn memory(&mut self) -> &mut impl Memory;
+ fn system(&mut self) -> &mut impl System;
}
pub struct BitBox02Sd;
@@ -315,12 +320,21 @@ impl Memory for BitBox02Memory {
}
}
+pub struct BitBox02System;
+
+impl System for BitBox02System {
+ fn reboot_to_bootloader(&mut self) -> ! {
+ bitbox02::reboot_to_bootloader()
+ }
+}
+
pub struct BitBox02Hal {
ui: RealWorkflows,
sd: BitBox02Sd,
random: BitBox02Random,
securechip: BitBox02SecureChip,
memory: BitBox02Memory,
+ system: BitBox02System,
}
impl BitBox02Hal {
@@ -331,6 +345,7 @@ impl BitBox02Hal {
random: BitBox02Random,
securechip: BitBox02SecureChip,
memory: BitBox02Memory,
+ system: BitBox02System,
}
}
}
@@ -351,6 +366,9 @@ impl Hal for BitBox02Hal {
fn memory(&mut self) -> &mut impl Memory {
&mut self.memory
}
+ fn system(&mut self) -> &mut impl System {
+ &mut self.system
+ }
}
#[cfg(feature = "testing")]
@@ -861,12 +879,27 @@ pub mod testing {
}
}
+ pub struct TestingSystem;
+
+ impl TestingSystem {
+ pub fn new() -> Self {
+ Self
+ }
+ }
+
+ impl super::System for TestingSystem {
+ fn reboot_to_bootloader(&mut self) -> ! {
+ panic!("reboot_to_bootloader called")
+ }
+ }
+
pub struct TestingHal<'a> {
pub ui: crate::workflow::testing::TestingWorkflows<'a>,
pub sd: TestingSd,
pub random: TestingRandom,
pub securechip: TestingSecureChip,
pub memory: TestingMemory,
+ pub system: TestingSystem,
}
impl TestingHal<'_> {
@@ -877,6 +910,7 @@ pub mod testing {
random: TestingRandom::new(),
securechip: TestingSecureChip::new(),
memory: TestingMemory::new(),
+ system: TestingSystem::new(),
}
}
}
@@ -897,6 +931,9 @@ pub mod testing {
fn memory(&mut self) -> &mut impl super::Memory {
&mut self.memory
}
+ fn system(&mut self) -> &mut impl super::System {
+ &mut self.system
+ }
}
#[cfg(test)]
diff --git a/src/rust/bitbox02-rust/src/hww/api/system.rs b/src/rust/bitbox02-rust/src/hww/api/system.rs
index ce6114f..b32ab80 100644
--- a/src/rust/bitbox02-rust/src/hww/api/system.rs
+++ b/src/rust/bitbox02-rust/src/hww/api/system.rs
@@ -6,7 +6,7 @@ use crate::pb;
use pb::reboot_request::Purpose;
use pb::response::Response;
-use crate::hal::Ui;
+use crate::hal::{System, Ui};
use crate::workflow::confirm;
pub async fn reboot_to_bootloader(
@@ -26,7 +26,7 @@ pub async fn reboot_to_bootloader(
..Default::default()
})
.await?;
- bitbox02::reboot_to_bootloader()
+ hal.system().reboot_to_bootloader()
}
#[cfg(test)]
diff --git a/src/rust/bitbox02/src/lib.rs b/src/rust/bitbox02/src/lib.rs
index 01cfdb3..6200c50 100644
--- a/src/rust/bitbox02/src/lib.rs
+++ b/src/rust/bitbox02/src/lib.rs
@@ -220,17 +220,12 @@ pub fn format_datetime(
})
}
-#[cfg(not(feature = "testing"))]
+#[allow(clippy::empty_loop)]
pub fn reboot_to_bootloader() -> ! {
unsafe { bitbox02_sys::reboot_to_bootloader() }
loop {}
}
-#[cfg(feature = "testing")]
-pub fn reboot_to_bootloader() -> ! {
- panic!("reboot_to_bootloader called")
-}
-
#[cfg(any(feature = "testing", feature = "c-unit-testing"))]
pub fn print_stdout(msg: &str) {
unsafe {
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.