feat(core): introduce error handling macros
What changed, and why it matters
This commit adds a new set of helper macros for handling error codes inside the Trezor firmware's core runtime library. It is purely a code-structure addition: it defines patterns like 'if something failed, jump to cleanup code and return the error.' There is no bug fix, no behavior change to existing code, and no security vulnerability present in the diff itself.
No security action needed. Review future commits that adopt these macros to ensure cleanup paths do not introduce resource leaks, double-frees, or skipped security checks.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change introduces TSH_DECLARE, TSH_RETURN, TSH_CHECK_OK, TSH_CHECK, TSH_CHECK_ARG, and TSH_CHECK_SEC macros in core/embed/rtl/inc/rtl/error_handling.h. These provide a goto-based cleanup idiom for ts_t status codes. The macros are not yet used anywhere in the codebase in this commit, and no existing logic is modified. The implementation is straightforward and contains no obvious macro hygiene issues (arguments are parenthesized, local variables use underscored names to avoid shadowing).
Changed components
core/embed/rtl/inc/rtl/error_handling.hInspect captured patch +107 / −0
diff --git a/core/embed/rtl/inc/rtl/error_handling.h b/core/embed/rtl/inc/rtl/error_handling.h
index 3b2f3771c..345d0a3f2 100644
--- a/core/embed/rtl/inc/rtl/error_handling.h
+++ b/core/embed/rtl/inc/rtl/error_handling.h
@@ -173,3 +173,110 @@ void __attribute__((noreturn)) error_shutdown(const char *message);
*/
void __attribute__((noreturn))
__fatal_error(const char *msg, const char *file, int line);
+
+/*
+ * TSH_DECLARE, TSH_RETURN and TSH_CHECK_xxx() macros define
+ * a simple error handling mechanism
+ *
+ * Example:
+ *
+ * // Preferably use `__wur` attribute to ensure that the return value
+ * // is not ignored
+ * ts_t __wur my_function(int arg) {
+ * // Initialize verify mechanism
+ * TSH_DECLARE;
+ *
+ * // Check arguments
+ * TSH_CHECK_ARG(arg > 0);
+ *
+ * ts_t status;
+ *
+ * // Verify success
+ * status = some_function();
+ * TSH_CHECK_OK(status);
+ *
+ * // Verify condition
+ * TSH_CHECK(another_function() != 0, TS_ERROR_IO);
+ *
+ * cleanup:
+ *
+ * // clean up code comes here
+ *
+ * TSH_RETURN;
+ * }
+ */
+
+/**
+ * Declares a status variable and initializes it to `TS_OK`.
+ *
+ * The defined variable is in subsequent macros used to track the
+ * status within a function.
+ */
+#define TSH_DECLARE __attribute__((unused)) ts_t __status = TS_OK;
+
+/**
+ * Returns the most recently stored status value.
+ */
+#define TSH_RETURN \
+ do { \
+ return __status; \
+ } while (0)
+
+/**
+ * Checks the status, if it indicates an error, set
+ * status variable and jumps to `cleanup` label.
+ *
+ * @param status status value to check
+ */
+#define TSH_CHECK_OK(status) \
+ do { \
+ ts_t _status = status; \
+ if (ts_error(_status)) { \
+ __status = _status; \
+ goto cleanup; \
+ } \
+ } while (0)
+
+/**
+ * Checks the condition, if it is not `true`, set status variable
+ * and jumps to `cleanup` label.
+ *
+ * @param cond Condition to check
+ * @param status status value to set if condition is not true
+ */
+#define TSH_CHECK(cond, status) \
+ do { \
+ if (!(cond)) { \
+ __status = status; \
+ goto cleanup; \
+ } \
+ } while (0)
+
+/**
+ * Checks the condition, if it is not `true`, set status variable
+ * to `TS_EINVAL` and jumps to `cleanup` label.
+ *
+ * @param cond Condition to check
+ */
+#define TSH_CHECK_ARG(cond) \
+ do { \
+ if (!(cond)) { \
+ __status = TS_EINVAL; \
+ goto cleanup; \
+ } \
+ } while (0)
+
+/**
+ * Checks the (secbool) condition, if it is not `sectrue`, set
+ * status variable and jumps to `cleanup` label.
+ *
+ * @param seccond Security condition to check
+ * @param status status value to set if condition is not sectrue
+ */
+#define TSH_CHECK_SEC(seccond, status) \
+ do { \
+ if ((seccond) != sectrue) { \
+ __status = status; \
+ goto cleanup; \
+ } \
+ } while (0)
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.