build(core): exclude `storage.cache_codec` from THP builds
What the developer wrote
Authored by Roman Zeyde
build(core): exclude `storage.cache_codec` from THP builds
THP PYOPT=1 builds don't need it.
THP PYOPT=0 builds need DebugLink functionality, but don't use `CodecContext`'s cache-related methods.
Reduces THP build flash usage by ~1kB.
[no changelog]
What changed, and why it matters
This is a build-system cleanup for Trezor firmware. It removes an unused storage cache module from a specific firmware variant (THP builds) to save about 1 kB of flash space. The code change also makes sure that when the module is excluded, the few functions that relied on it are skipped too. There is no direct security bug here, but any build-system change that alters which code is compiled into a hardware wallet deserves a quick sanity check.
Verify that THP builds (both PYOPT=0 and PYOPT=1) still boot and pass wire/codec tests, and that no runtime path accidentally calls the excluded `cache_codec` methods. Confirm the ~1 kB flash savings and that no functional regression was introduced for DebugLink on PYOPT=0 builds.
Security signals we found
Build-system change that changes which security-relevant modules are frozen into firmware images
Conditional compilation of session/cache access code based on USE_THP flag
No changelog entry provided by vendor
No explicit security relevance disclosed by vendor
Evidence from the diff
The commit excludes storage.cache_codec and its keys from THP (Trezor Host Protocol) builds in both firmware and Unix emulator SConscripts. In codec_context.py, the unconditional import of cache_codec is removed and the release() and cache property methods are gated behind if not utils.USE_THP, with imports moved inside those methods. This is a size-reduction refactor; the commit message explicitly states the motivation is flash usage, not a security fix.
Changed components
core/SConscript.firmwarecore/SConscript.unixcore/src/trezor/wire/codec/codec_context.pyTHP firmware buildsDebugLink/PYOPT=0 buildsInspect captured patch +25 / −18
diff --git a/core/SConscript.firmware b/core/SConscript.firmware
index 3aaa78f6..f96a662e 100644
--- a/core/SConscript.firmware
+++ b/core/SConscript.firmware
@@ -699,11 +699,10 @@ if FROZEN:
([
SOURCE_PY_DIR + 'storage/cache_codec.py',
SOURCE_PY_DIR + 'storage/cache_codec_keys.py'
- ] if THP and PYOPT != '0' else []) +
- ([
+ ] if THP else [
SOURCE_PY_DIR + 'storage/cache_thp.py',
SOURCE_PY_DIR + 'storage/cache_thp_keys.py'
- ] if not THP else [])
+ ])
)
))
diff --git a/core/SConscript.unix b/core/SConscript.unix
index a0e6c399..cd53c098 100644
--- a/core/SConscript.unix
+++ b/core/SConscript.unix
@@ -714,11 +714,10 @@ if FROZEN:
([
SOURCE_PY_DIR + 'storage/cache_codec.py',
SOURCE_PY_DIR + 'storage/cache_codec_keys.py'
- ] if THP and PYOPT != '0' else []) +
- ([
+ ] if THP else [
SOURCE_PY_DIR + 'storage/cache_thp.py',
SOURCE_PY_DIR + 'storage/cache_thp_keys.py'
- ] if not THP else [])
+ ])
)
))
diff --git a/core/src/trezor/wire/codec/codec_context.py b/core/src/trezor/wire/codec/codec_context.py
index d3a65fd0..d970fef1 100644
--- a/core/src/trezor/wire/codec/codec_context.py
+++ b/core/src/trezor/wire/codec/codec_context.py
@@ -1,8 +1,6 @@
from typing import TYPE_CHECKING, Awaitable, Container
-from storage import cache_codec
-from storage.cache_common import DataCache, InvalidSessionError
-from trezor import protobuf
+from trezor import protobuf, utils
from trezor.wire.codec import codec_v1
from trezor.wire.context import UnexpectedMessageException
from trezor.wire.message_handler import wrap_protobuf_load
@@ -15,6 +13,8 @@ if __debug__:
if TYPE_CHECKING:
from typing import TypeVar
+ from storage.cache_common import DataCache
+
from .. import Provider, WireInterface
LoadedMessageType = TypeVar("LoadedMessageType", bound=protobuf.MessageType)
@@ -111,13 +111,22 @@ class CodecContext(Context):
memoryview(buffer)[:msg_size],
)
- def release(self) -> None:
- cache_codec.end_current_session()
+ if not utils.USE_THP:
+ # Note: we use the above CodecContext functionality for DebugLink on PYOPT=0 builds.
+ # The methods below are excluded for THP builds, since cache_codec is not available.
+
+ def release(self) -> None:
+ from storage.cache_codec import end_current_session
+
+ end_current_session()
+
+ # ACCESS TO CACHE
+ @property
+ def cache(self) -> DataCache:
+ from storage.cache_codec import get_active_session
+ from storage.cache_common import InvalidSessionError
- # ACCESS TO CACHE
- @property
- def cache(self) -> DataCache:
- c = cache_codec.get_active_session()
- if c is None:
- raise InvalidSessionError()
- return c
+ c = get_active_session()
+ if c is None:
+ raise InvalidSessionError()
+ return c
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.