refactor(core/bootloader): drop the unreachable turn_on command list
What the developer wrote
Authored by tychovrahe
refactor(core/bootloader): drop the unreachable turn_on command list
The command enumeration has been dead since ad3cb11056 ("start the device on
short press"). That commit widened the condition below it from
`manufacturing_mode && cmd != BOOT_COMMAND_POWER_OFF` to just the latter, which
subsumes the list entirely -- nothing the list selects can still change the
outcome.
The widening was deliberate. What the list was trying to express is already
covered: BOOT_COMMAND_POWER_OFF is set in exactly one place
(reboot_and_power_off), so it alone marks the state that has no reason to boot.
Every other command boots through -- and a boot with the button held still reaches
the press loop via the button_is_down check just
below, so long-press bootloader entry is unaffected.
Keeping the enumeration around only implies it still selects something, and any
command added to it is a silent no-op.
[no changelog]
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
What changed, and why it matters
This is a code cleanup in the Trezor bootloader. It removes a list of commands that was no longer doing anything useful, because a simpler check already covered all cases. There is no security bug being fixed here; the change only makes the code easier to understand and prevents future mistakes where someone might add a command to the now-deleted list and expect it to matter.
No security action required. Treat as a normal code-quality refactor. Reviewers may optionally verify that no other code depends on the removed `turn_on` assignment behavior, though the diff and commit message make clear the logic is equivalent.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit refactors boot_sequence() in core/embed/projects/bootloader/main.c. Previously, turn_on was set by enumerating several BOOT_COMMAND_* values, then unconditionally set to true if the command was not BOOT_COMMAND_POWER_OFF. Since the latter condition already made the enumeration redundant, the patch replaces both with a single boolean expression turn_on = (cmd != BOOT_COMMAND_POWER_OFF). The subsequent button_is_down(BTN_POWER) override remains unchanged. The commit message explicitly states this is a non-functional refactor and that long-press bootloader entry is unaffected.
Changed components
core/embed/projects/bootloader/main.cInspect captured patch +3 / −8
### core/embed/projects/bootloader/main.c
@@ -195,14 +195,9 @@ static secbool boot_sequence(void) {
boot_command_t cmd = bootargs_get_command();
- bool turn_on =
- (cmd == BOOT_COMMAND_INSTALL_UPGRADE || cmd == BOOT_COMMAND_REBOOT ||
- cmd == BOOT_COMMAND_SHOW_RSOD || cmd == BOOT_COMMAND_WIPE ||
- cmd == BOOT_COMMAND_STOP_AND_WAIT);
-
- if (cmd != BOOT_COMMAND_POWER_OFF) {
- turn_on = true;
- }
+ // Turns on unless the command is power off or unless the power button is
+ // held down.
+ bool turn_on = (cmd != BOOT_COMMAND_POWER_OFF);
if (button_is_down(BTN_POWER)) {
turn_on = false;Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.