perf(core): drop nanopb error strings from bootloader
What the developer wrote
Authored by tychovrahe
perf(core): drop nanopb error strings from bootloader
nanopb's error message strings are linked into the bootloader image, but
nothing reads `pb_(i|o)stream_t::errmsg`. Defining PB_NO_ERRMSG removes
them along with the PB_SET_ERROR code paths.
The three `.errmsg = NULL` initializers in codec_v1.c go away with the
struct field. Dropping them rather than #ifdef-guarding them keeps the
code correct either way, since designated initializers zero the rest.
bootloader_ci is untouched: it has its own messages.c and build.rs.
Recovers 976 B of flash. T3T1 bootloader free space (--production):
28 B -> 1004 B.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
[no changelog]
What changed, and why it matters
This change removes unused error-message text from the bootloader's copy of the nanopb library to free up about 1 kB of flash storage. The bootloader never looked at these error strings anyway, so the change is a size optimization with no security effect.
No security action required; treat as a normal size-optimization change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit defines PB_NO_ERRMSG for the bootloader build and removes the .errmsg = NULL designated initializers in codec_v1.c. Because PB_NO_ERRMSG removes the errmsg field from pb_istream_t/pb_ostream_t, the initializers would no longer compile; removing them is safe because designated initializers zero all omitted fields. The patch only affects the bootloader (not bootloader_ci) and is purely a code-size/performance optimization.
Changed components
core/embed/projects/bootloader/build.rscore/embed/projects/bootloader/wire/codec_v1.cInspect captured patch +7 / −8
### core/embed/projects/bootloader/build.rs
@@ -16,6 +16,9 @@ fn main() -> Result<()> {
("PB_FIELD_16BIT", Some("1")),
("PB_ENCODE_ARRAYS_UNPACKED", Some("1")),
("PB_VALIDATE_UTF8", Some("1")),
+ // Drops nanopb's error message strings (~1 kB of flash). Nothing
+ // in the bootloader reads `pb_(i|o)stream_t::errmsg`.
+ ("PB_NO_ERRMSG", Some("1")),
]);
lib.add_sources([
### core/embed/projects/bootloader/wire/codec_v1.c
@@ -111,8 +111,7 @@ secbool codec_send_msg(wire_iface_t *iface, uint16_t msg_id,
pb_ostream_t sizestream = {.callback = NULL,
.state = NULL,
.max_size = SIZE_MAX,
- .bytes_written = 0,
- .errmsg = NULL};
+ .bytes_written = 0};
if (!pb_encode(&sizestream, fields, msg)) {
return secfalse;
}
@@ -138,8 +137,7 @@ secbool codec_send_msg(wire_iface_t *iface, uint16_t msg_id,
pb_ostream_t stream = {.callback = &write,
.state = &state,
.max_size = SIZE_MAX,
- .bytes_written = 0,
- .errmsg = NULL};
+ .bytes_written = 0};
if (!pb_encode(&stream, fields, msg)) {
return secfalse;
@@ -209,10 +207,8 @@ secbool codec_recv_message(wire_iface_t *iface, uint32_t msg_size, uint8_t *buf,
packet_read_state_t state = {
.iface = iface, .packet_pos = MSG_HEADER1_LEN, .buf = buf};
- pb_istream_t stream = {.callback = &read,
- .state = &state,
- .bytes_left = msg_size,
- .errmsg = NULL};
+ pb_istream_t stream = {
+ .callback = &read, .state = &state, .bytes_left = msg_size};
if (!pb_decode_noinit(&stream, fields, msg)) {
return secfalse;Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.