Merge pull request #712 from Foundation-Devices/sft-8229-replace-every-mp_check_self-guard-in-extmodfoundation-with

### .github/workflows/lint.yaml
@@ -18,6 +18,26 @@ jobs:
       - uses: actions/checkout@v6
       - run: make -C extmod/quirc/tests test
 
+  # The foundation bindings validate their arguments with explicit raises.
+  # mp_check_self is not the mechanism for that here: it addresses a different
+  # case, which the interpreter already covers for us. Keep it out of this tree.
+  #
+  # Scoped to our own bindings on purpose. Uses under extmod/trezor-firmware/
+  # are upstream's and are correct for what they do.
+  bindings-validate-explicitly:
+    name: Do the foundation bindings validate explicitly?
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - run: |
+          if grep -rn 'mp_check_self' extmod/foundation/; then
+            echo "::error::Validate explicitly in extmod/foundation/:"\
+                 "mp_raise_TypeError() for a wrong argument type,"\
+                 "mp_raise_msg(&mp_type_ValueError, ...) for a wrong variant or"\
+                 "an absent optional field. See SFT-8229."
+            exit 1
+          fi
+
   rust-code-compiles:
     name: Rust code compiles?
     runs-on: ubuntu-latest

### extmod/foundation/modfoundation-bip39.h
@@ -25,7 +25,9 @@ extern word_info_t bytewords_word_info[]; // TODO: Restructure this so bip39 and
 ///     '''
 STATIC mp_obj_t mod_foundation_bip39_get_words_matching_prefix(size_t n_args, const mp_obj_t *args)
 {
-    mp_check_self(mp_obj_is_str_or_bytes(args[0]));
+    if (!mp_obj_is_str_or_bytes(args[0])) {
+        mp_raise_TypeError(MP_ERROR_TEXT("prefix must be a string"));
+    }
     GET_STR_DATA_LEN(args[0], prefix_str, prefix_len);
 
     mp_int_t max_matches = mp_obj_get_int(args[1]);
@@ -36,7 +38,9 @@ STATIC mp_obj_t mod_foundation_bip39_get_words_matching_prefix(size_t n_args, co
     }
 
     // Must be "bip39" or "bytewords"
-    mp_check_self(mp_obj_is_str_or_bytes(args[2]));
+    if (!mp_obj_is_str_or_bytes(args[2])) {
+        mp_raise_TypeError(MP_ERROR_TEXT("word_list must be a string"));
+    }
     GET_STR_DATA_LEN(args[2], word_list_str, word_list_len);
 
     const word_info_t *word_info = NULL;
@@ -81,7 +85,9 @@ STATIC MP_DEFINE_CONST_FUN_OBJ_VAR_BETWEEN(mod_foundation_bip39_get_words_matchi
 ///     '''
 STATIC mp_obj_t mod_foundation_bip39_mnemonic_to_bits(mp_obj_t mnemonic, mp_obj_t entropy)
 {
-    mp_check_self(mp_obj_is_str_or_bytes(mnemonic));
+    if (!mp_obj_is_str_or_bytes(mnemonic)) {
+        mp_raise_TypeError(MP_ERROR_TEXT("mnemonic must be a string"));
+    }
     GET_STR_DATA_LEN(mnemonic, mnemonic_str, mnemonic_len);
     mp_buffer_info_t entropy_info;
     mp_get_buffer_raise(entropy, &entropy_info, MP_BUFFER_WRITE);

### extmod/foundation/modfoundation-ur.h
@@ -145,7 +145,9 @@ STATIC MP_DEFINE_CONST_FUN_OBJ_1(mod_foundation_ur_Value_unwrap_bytes_obj,
 ///     """
 STATIC mp_obj_t mod_foundation_ur_Value_unwrap_psbt(mp_obj_t self_in) {
     mp_obj_Value_t *self = MP_OBJ_TO_PTR(self_in);
-    mp_check_self(self->value.tag == Psbt);
+    if (self->value.tag != Psbt) {
+        mp_raise_msg(&mp_type_ValueError, MP_ERROR_TEXT("expected psbt UR"));
+    }
 
     return mp_obj_new_bytearray_by_ref(self->value.psbt.len, (void *)self->value.psbt.data);
 }
@@ -157,7 +159,9 @@ STATIC MP_DEFINE_CONST_FUN_OBJ_1(mod_foundation_ur_Value_unwrap_psbt_obj,
 ///     """
 STATIC mp_obj_t mod_foundation_ur_Value_unwrap_passport_request(mp_obj_t self_in) {
     mp_obj_Value_t *self = MP_OBJ_TO_PTR(self_in);
-    mp_check_self(self->value.tag == PassportRequest);
+    if (self->value.tag != PassportRequest) {
+        mp_raise_msg(&mp_type_ValueError, MP_ERROR_TEXT("expected passport-request UR"));
+    }
 
     return MP_OBJ_FROM_PTR(mod_foundation_ur_PassportRequest_new(&self->value.passport_request));
 }
@@ -330,8 +334,10 @@ STATIC MP_DEFINE_CONST_FUN_OBJ_1(mod_foundation_ur_PassportRequest_uuid_obj,
 
 STATIC mp_obj_t mod_foundation_ur_PassportRequest_scv_challenge_id(mp_obj_t self_in)
 {
-    mp_check_self(self->passport_request.has_scv_challenge);
     mp_obj_PassportRequest_t *self = MP_OBJ_TO_PTR(self_in);
+    if (!self->passport_request.has_scv_challenge) {
+        mp_raise_msg(&mp_type_ValueError, MP_ERROR_TEXT("request has no SCV challenge"));
+    }
 
     return mp_obj_new_bytes(self->passport_request.scv_challenge.id, 32);
 }
@@ -340,8 +346,10 @@ STATIC MP_DEFINE_CONST_FUN_OBJ_1(mod_foundation_ur_PassportRequest_scv_challenge
 
 STATIC mp_obj_t mod_foundation_ur_PassportRequest_scv_challenge_signature(mp_obj_t self_in)
 {
-    mp_check_self(self->passport_request.has_scv_challenge);
     mp_obj_PassportRequest_t *self = MP_OBJ_TO_PTR(self_in);
+    if (!self->passport_request.has_scv_challenge) {
+        mp_raise_msg(&mp_type_ValueError, MP_ERROR_TEXT("request has no SCV challenge"));
+    }
 
     return mp_obj_new_bytes(self->passport_request.scv_challenge.signature, 64);
 }
@@ -694,7 +702,9 @@ STATIC mp_obj_t mod_foundation_ur_decoder_receive(mp_obj_t ur_obj)
 {
     UR_Error error = {0};
 
-    mp_check_self(mp_obj_is_str(ur_obj));
+    if (!mp_obj_is_str(ur_obj)) {
+        mp_raise_TypeError(MP_ERROR_TEXT("ur must be a string"));
+    }
     GET_STR_DATA_LEN(ur_obj, ur, ur_len);
 
     uint32_t num_frames = 0;
@@ -771,7 +781,9 @@ STATIC MP_DEFINE_CONST_FUN_OBJ_0(mod_foundation_ur_decoder_decode_message_obj,
 ///     """
 STATIC mp_obj_t mod_foundation_ur_validate(mp_obj_t ur_obj)
 {
-    mp_check_self(mp_obj_is_str(ur_obj));
+    if (!mp_obj_is_str(ur_obj)) {
+        mp_raise_TypeError(MP_ERROR_TEXT("ur must be a string"));
+    }
     GET_STR_DATA_LEN(ur_obj, ur, ur_len);
 
     return ur_validate(ur, ur_len) ? mp_const_true : mp_const_false;
@@ -786,7 +798,9 @@ STATIC mp_obj_t mod_foundation_ur_decode_single_part(mp_obj_t ur_obj)
     UR_Error error = {0};
     UR_Value value = {0};
 
-    mp_check_self(mp_obj_is_str(ur_obj));
+    if (!mp_obj_is_str(ur_obj)) {
+        mp_raise_TypeError(MP_ERROR_TEXT("ur must be a string"));
+    }
     GET_STR_DATA_LEN(ur_obj, ur, ur_len);
 
     if (!ur_decode_single_part(ur, ur_len, &value, &error)) {

### ports/stm32/boards/Passport/modules/tests/test_unit.py
@@ -64,6 +64,10 @@ def test_multisig_qr_import(test):
     assert test('multisig_qr_import.py') == b'OK'
 
 
+def test_binding_argument_checks(test):
+    assert test('binding_argument_checks.py') == b'OK'
+
+
 def test_psbt_multisig_approval(test):
     assert test('psbt_multisig_approval.py') == b'OK'
 

### ports/stm32/boards/Passport/modules/tests/unit/binding_argument_checks.py
@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: © 2026 Foundation Devices, Inc. <hello@foundation.xyz>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# The foundation bindings validate their arguments with explicit raises. This
+# pins each one: the error type for an invalid argument, and the valid call
+# beside it so the checks cannot pass by refusing everything. See SFT-8229.
+
+from data_codecs.ur2_codec import UR2Decoder
+from foundation import bip39, ur
+
+CONFIG = b'Name: Test wallet\n'
+
+
+def must_raise(exc_type, call, what):
+    try:
+        call()
+    except exc_type:
+        return
+    except BaseException as other:
+        raise RuntimeError('{}: expected {}, got {}'.format(
+            what, exc_type.__name__, type(other).__name__))
+
+    raise RuntimeError('{}: expected {}, nothing raised'.format(what, exc_type.__name__))
+
+
+# Each unwrap accepts only its own variant.
+bytes_ur = ur.new_bytes(CONFIG)
+psbt_ur = ur.new_psbt(CONFIG)
+
+must_raise(ValueError, lambda: psbt_ur.unwrap_bytes(), 'unwrap_bytes on a psbt UR')
+must_raise(ValueError, lambda: bytes_ur.unwrap_psbt(), 'unwrap_psbt on a bytes UR')
+must_raise(ValueError, lambda: bytes_ur.unwrap_passport_request(),
+           'unwrap_passport_request on a bytes UR')
+
+# The matching variant still works, so the checks are not simply refusing.
+assert bytes_ur.unwrap_bytes() == CONFIG
+assert psbt_ur.unwrap_psbt() == CONFIG
+
+# A crypto-request with only a UUID and a model has no SCV challenge, so the
+# challenge accessors have nothing to return.
+request_cbor = b'\xa2\x01\xd8\x25\x50' + bytes(16) + b'\x03\xd9\x02\xd0\xf5'
+ur.encoder_start(ur.new_raw('crypto-request', request_cbor), 535)
+decoder = UR2Decoder()
+decoder.add_data(ur.encoder_next_part())
+assert decoder.is_complete()
+request = decoder.decode().unwrap_passport_request()
+
+must_raise(ValueError, lambda: request.scv_challenge_id(), 'scv_challenge_id without a challenge')
+must_raise(ValueError, lambda: request.scv_challenge_signature(),
+           'scv_challenge_signature without a challenge')
+
+# These three require a string argument.
+for name, call in (
+        ('ur.validate', lambda: ur.validate(123)),
+        ('ur.decode_single_part', lambda: ur.decode_single_part(123)),
+        ('ur.decoder_receive', lambda: ur.decoder_receive(123))):
+    must_raise(TypeError, call, name)
+
+# Same again in the bip39 bindings.
+must_raise(TypeError, lambda: bip39.get_words_matching_prefix(123, 5, 'bip39'),
+           'get_words_matching_prefix with a non-string prefix')
+must_raise(TypeError, lambda: bip39.get_words_matching_prefix('2', 5, 123),
+           'get_words_matching_prefix with a non-string word list')
+must_raise(TypeError, lambda: bip39.mnemonic_to_bits(123, bytearray(33)),
+           'mnemonic_to_bits with a non-string mnemonic')
+
+# And the valid calls beside them are unaffected.
+assert len(bip39.get_words_matching_prefix('2226366', 5, 'bip39')) > 0
+
+return_value.write(b'OK')