feat(xtask): allow --asan for all projects

Trezor/Trezor firmware

b9529b56 View source ↗

Public commit record

What the developer wrote

Authored by cepetr

57/100 · Thin

feat(xtask): allow --asan for all projects

[no changelog]

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit is a build-system feature change. It lets developers use the Address Sanitizer (ASAN) debugging tool with all Trezor firmware projects, not just the emulator. It also adds a guard that stops ASAN from being used in real hardware builds, where it is unsupported. There is no security vulnerability here.

Recommended action

No security action needed. Reviewers may verify the non-emulator ASAN guard works as intended, but the change is defensive.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The change exposes the asan feature across all embedded project manifests (boardloader, bootloader, bootloader_ci, firmware, kernel, prodtest, secmon) by wiring it through models/asan. In features.rs, the ASAN feature is no longer gated only on args.emulator; instead it is treated as a normal mapped option. In options.rs, asan is changed from opt to map so it is validated against each project’s declared build options. A new check in models/build.rs aborts non-emulator builds that enable ASAN. This is a developer tooling improvement, not a runtime code change.

Changed components

core/embed/xtask build option handlingcore/embed/projects/*/Cargo.toml and project.toml manifestscore/embed/models/build.rs

Inspect captured patch +20 / −6

### core/embed/models/build.rs
@@ -1,4 +1,4 @@
-use xbuild::{CLibrary, Result, bail_unsupported, cargo_out};
+use xbuild::{CLibrary, Result, bail, bail_unsupported, cargo_out};
 
 fn main() -> Result<()> {
     // Emit model identity for dependent build scripts (readable as
@@ -92,6 +92,10 @@ fn main() -> Result<()> {
                 lib.add_flag("-fstack-protector-all");
             }
 
+            if cfg!(feature = "asan") {
+                bail!("ASAN is not supported in non-emulator build");
+            }
+
             if cfg!(feature = "mcu_stm32f4") {
                 lib.add_flags([
                     "-mthumb",

### core/embed/projects/boardloader/Cargo.toml
@@ -28,6 +28,7 @@ sys.workspace = true
 # Build options
 # --------------------------------------------------------------------------
 
+asan = ["models/asan"]
 bootloader_devel = ["sec/bootloader_devel"]
 clippy = []
 emulator = ["io/emulator"]

### core/embed/projects/boardloader/project.toml
@@ -23,6 +23,7 @@ elf_sections = [".vector_table", ".text", ".data", ".rodata", ".capabilities"]
 # Build options mapped to the cargo features they activate on this project.
 # vcp is intentionally unmapped: the boardloader has no VCP console.
 [build-options]
+asan             = { true = ["asan"] }
 production       = { true = ["production"] }
 bootloader-devel = { true = ["bootloader_devel"] }
 dbg-console      = { swo = ["dbg_console_swo"], system-view = ["dbg_console_system_view"] }

### core/embed/projects/bootloader/Cargo.toml
@@ -23,6 +23,7 @@ trezor_lib.workspace = true
 # Build options
 # --------------------------------------------------------------------------
 
+asan = ["models/asan"]
 bootloader_devel = ["sec/bootloader_devel"]
 clippy = ["trezor_lib/clippy"]
 dbg_console_swo = ["dbg_console", "sys/dbg_console_swo"]

### core/embed/projects/bootloader/project.toml
@@ -47,6 +47,7 @@ elf_sections = [".header", ".flash", ".data"]
 
 # xtask build options mapped to the cargo features
 [build-options]
+asan              = { true = ["asan"] }
 bootloader-devel  = { true = ["bootloader_devel"] }
 dbg-console       = { vcp = ["dbg_console_vcp"], swo = ["dbg_console_swo"], system-view = ["dbg_console_system_view"] }
 debug-link        = { true = ["debuglink", "ui_debug"] }

### core/embed/projects/bootloader_ci/Cargo.toml
@@ -28,6 +28,7 @@ sys.workspace = true
 # Build options
 # --------------------------------------------------------------------------
 
+asan = ["models/asan"]
 bootloader_devel = ["sec/bootloader_devel"]
 clippy = []
 dbg_console_swo = ["dbg_console", "sys/dbg_console_swo"]

### core/embed/projects/bootloader_ci/project.toml
@@ -31,6 +31,7 @@ elf_sections = [".header", ".flash", ".data"]
 
 # xtask build options mapped to the cargo features
 [build-options]
+asan             = { true = ["asan"] }
 bootloader-devel = { true = ["bootloader_devel"] }
 dbg-console      = { vcp = ["dbg_console_vcp"], swo = ["dbg_console_swo"], system-view = ["dbg_console_system_view"] }
 production       = { true = ["production"] }

### core/embed/projects/firmware/Cargo.toml
@@ -24,6 +24,7 @@ upymod.workspace = true
 # Build options
 # --------------------------------------------------------------------------
 
+asan = ["models/asan"]
 benchmark = ["upymod/benchmark", "crypto/aes_gcm"]
 block_on_vcp = ["sys/block_on_vcp"]
 bootloader_devel = ["sec/bootloader_devel"]

### core/embed/projects/firmware/project.toml
@@ -56,6 +56,7 @@ split_part2_sections = [".flash2"]
 
 # xtask build options mapped to the cargo features
 [build-options]
+asan                          = { true = ["asan"] }
 apps                          = { true = ["app_loading"] }
 benchmark                     = { true = ["benchmark"] }
 block-on-vcp                  = { true = ["block_on_vcp"] }

### core/embed/projects/kernel/Cargo.toml
@@ -22,6 +22,7 @@ sys.workspace = true
 # Build options
 # --------------------------------------------------------------------------
 
+asan = ["models/asan"]
 app_loading = ["io/app_loading", "io/ipc"]
 bootloader_devel = ["sec/bootloader_devel"]
 clippy = []

### core/embed/projects/kernel/project.toml
@@ -44,6 +44,7 @@ elf_sections = [".flash", ".data"]
 
 # xtask build options mapped to the cargo features
 [build-options]
+asan                          = { true = ["asan"] }
 apps                          = { true = ["app_loading"] }
 block-on-vcp                  = { true = ["block_on_vcp"] }
 bootloader-devel              = { true = ["bootloader_devel"] }

### core/embed/projects/prodtest/Cargo.toml
@@ -22,6 +22,7 @@ trezor_lib.workspace = true
 # Build options
 # --------------------------------------------------------------------------
 
+asan = ["models/asan"]
 bootloader_devel = ["sec/bootloader_devel"]
 clippy = ["trezor_lib/clippy"]
 dbg_console_swo = ["dbg_console", "sys/dbg_console_swo"]

### core/embed/projects/prodtest/project.toml
@@ -55,6 +55,7 @@ secmon_header_sections = [".vendorheader", ".header"]
 
 # xtask build options mapped to the cargo features.
 [build-options]
+asan             = { true = ["asan"] }
 bootloader-devel = { true = ["bootloader_devel"] }
 dbg-console      = { swo = ["dbg_console_swo"], system-view = ["dbg_console_system_view"] }
 debug-link       = { true = ["debuglink", "ui_debug"] }

### core/embed/projects/secmon/Cargo.toml
@@ -27,6 +27,7 @@ sys.workspace = true
 # Build options
 # --------------------------------------------------------------------------
 
+asan = ["models/asan"]
 bootloader_devel = ["sec/bootloader_devel"]
 clippy = []
 emulator = ["sec/emulator"]

### core/embed/projects/secmon/project.toml
@@ -24,6 +24,7 @@ elf_sections = [".secmon_header", ".flash", ".data", ".gnu.sgstubs"]
 
 # xtask build options mapped to the cargo features
 [build-options]
+asan                          = { true = ["asan"] }
 bootloader-devel              = { true = ["bootloader_devel"] }
 btc-only                      = { false = ["universal_fw"] }
 dbg-console                   = { swo = ["dbg_console_swo"], system-view = ["dbg_console_system_view"] }

### core/embed/xtask/src/features.rs
@@ -38,10 +38,6 @@ pub fn resolve_features(args: &ResolvedBuildArgs) -> Result<ResolvedBuildFeature
 
     if args.emulator {
         features.push("emulator".into());
-
-        if args.asan {
-            features.push("asan".into());
-        }
     }
 
     // Option-mapped features, validated against the target package's declared

### core/embed/xtask/src/options.rs
@@ -227,7 +227,7 @@ build_options! {
 
     /// Enable Address Sanitizer (ASAN) instrumentation
     #[arg(long, num_args = 0..=1, default_missing_value = "true")]
-    opt asan: bool,
+    map asan: bool,
 
     /// Enable external app loading
     #[arg(long, num_args = 0..=1, default_missing_value = "true")]

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

chore(core): improvements to English copy

feat(core): app root packet downgrade protection

fix(core/rust): discard low-order keys in THP handshake