Reboot on the way out of a wallet session

Leaving the wallet viewer unwound back to the main menu, wiping the three
buffers show_wallet_data owns and leaving everything between there and Home
holding whatever it last held - wiped only where someone had remembered to
wipe it. The stated safety boundary is that every screen holding seed material
clears its buffers, and that boundary was being kept by a hundred-odd
individual calls and the discipline to add the next one.

Both ways out now reboot: the row, and the timeout that means the reader
walked away from a device with a seed on it. A restart re-runs C startup,
which zeroes .bss - where the address cache and the review rows live - and
leaves nothing on a stack about to be reused from the top. It is the same
seedtool_platform_restart() the main-menu timeout, a failed assertion and
__wrap_abort already use; ending a session was the one exit that did not.

The explicit wipes still run first. The reboot is the belt and they are the
braces, and the braces are what protect the buffers while a session is still
running, which the reboot cannot do at all.

The row is "Erase and restart" now, because that is what it does. It arrived
last commit as "Erase and exit" for the good reason that "Shutdown" promised a
power state the device did not enter - the same objection applies to any name
that overstates, so the name moves with the behaviour rather than ahead of it.

What this costs: brightness and orientation live only in RAM, by design, so
they return to their defaults at the end of every session. That is the trade,
stated plainly - a display preference is recoverable in two presses and a seed
is not.

Three comments describing the old unwinding are corrected rather than left to
misinform: the review-rows wipe, and the two either side of create_seed's
return value, which now only reaches its caller when the viewer never opened.

Verified with the host self-test, 49 Python tests, and a firmware build the
audit passes at 300560 bytes. Not yet walked on hardware.

Author: oroderico

README.md

@@ -302,7 +302,7 @@ never padded with blank rows. Only labels are listed. Values meant to be transcr
 instead, split by what fits the display.
 
 The last row of every list with somewhere to return to is the way out of it —
-`Back`, `Erase and exit`, `[delete]` — and a rule is drawn above it so it is not
+`Back`, `Erase and restart`, `[delete]` — and a rule is drawn above it so it is not
 read as one more choice. That row is always last, in every such list, so
 leaving a screen is always in the same place. The one list with nowhere to
 return to is the main menu itself: there is no `Back` row there, and the

host/origo_simulator.c

@@ -431,7 +431,7 @@ static bool word_numbers_round_trip_is_sound(void)
  * last glyph that fits; nothing here is transcribed, but a silently shortened
  * label still misnames what the buttons are about to do. */
 static const char* const menu_labels[] = { "Master fingerprint", "Native SegWit (BIP84)", "Taproot (BIP86)",
-    "Account key", "Addresses", "Account key format", "xpub", "zpub", "Erase and exit", "New Seed", "From entropy",
+    "Account key", "Addresses", "Account key format", "xpub", "zpub", "Erase and restart", "New Seed", "From entropy",
     "Restore Seed", "Complete checksum", "About", "Settings", "11 words + 7 coins", "23 words + 3 coins",
     "No passphrase", "Enter passphrase", "D6 dice", "D20 dice", "Coin flips", "Cards", "Back", "12 words",
     "24 words", "[delete]", "[back]", "Type the letters", "Enter word numbers", "Plain text", "Backup",

main/seedtool_app.c

@@ -1266,9 +1266,11 @@ static int review_and_confirm(char words[][SEEDTOOL_MAX_WORD_LEN + 1], const siz
      * address_labels: these rows are the mnemonic in plain text, one word
      * each, and they live in .bss rather than on a stack frame that the next
      * screen would overwrite anyway. Leaving them behind kept a restored seed
-     * readable in RAM for the rest of the session - past "Erase and exit" and
-     * past the session-timeout screen, which erases nothing here. Clearing on
-     * entry as well as exit keeps a 12-word restore from leaving rows 12..23
+     * readable in RAM for the rest of the session. Both ways out of the wallet
+     * now reboot, and C startup zeroes .bss, so that particular leak would no
+     * longer outlive the session - but this wipe is what makes the rows gone
+     * while the session is still running, which the reboot cannot do. Clearing
+     * on entry as well as exit keeps a 12-word restore from leaving rows 12..23
      * of a previous 24-word one on show. */
     seedtool_zero(review_labels, sizeof(review_labels));
     for (;;) {
@@ -2149,10 +2151,26 @@ static void show_wallet_data(const char* mnemonic)
     (void)snprintf(wallet_title, sizeof(wallet_title), "Wallet @%s", fphex);
     size_t cursor = 0;
     for (;;) {
-        const char* menu[] = { "Backup", "Extended public key", "Derivation", "Addresses", "Erase and exit" };
+        const char* menu[] = { "Backup", "Extended public key", "Derivation", "Addresses", "Erase and restart" };
         const int selected = choose_kept(wallet_title, menu, sizeof(menu) / sizeof(menu[0]), true, &cursor);
+        /* Both ways out of a wallet session reboot: the row, and the timeout
+         * that means the reader walked away from a device with a seed on it.
+         * Unwinding instead would leave every buffer between here and the main
+         * menu holding what it last held, wiped only where someone remembered
+         * to wipe it. A restart re-runs C startup, which zeroes .bss - the
+         * address cache and the review rows live there - and leaves nothing on
+         * a stack that is about to be reused from the top. The explicit wipes
+         * below still run first: the reboot is the belt, not a reason to drop
+         * the braces.
+         *
+         * The cost is the display settings, which are RAM-only by design and
+         * so go back to their defaults. That is the trade this makes
+         * deliberately: brightness is a preference, and the seed is not. */
         if (selected < 0 || selected == 4) {
-            break;
+            seedtool_zero(fp, sizeof(fp));
+            seedtool_zero(fphex, sizeof(fphex));
+            seedtool_zero(passphrase, sizeof(passphrase));
+            seedtool_platform_restart();
         }
         switch (selected) {
         case 0:
@@ -2538,11 +2556,15 @@ static int collect_entropy(const int source, const size_t words)
     return outcome;
 }
 
-/* Returns whether a seed was actually generated and carried all the way
- * through the wallet viewer to Erase and exit (or a timeout) - as opposed to the
- * reader backing out of the source or length picker before ever starting.
+/* Returns whether a seed was actually generated, as opposed to the reader
+ * backing out of the source or length picker before ever starting.
  * show_new_seed_menu uses this to tell "done, go all the way home" apart from
- * plain "back one level". */
+ * plain "back one level".
+ *
+ * Since leaving the wallet viewer reboots, the true case now only reaches its
+ * caller when the viewer returned without ever opening - a derivation failure
+ * on the way in. The distinction still has to exist for that, and for the
+ * false case, which is the ordinary back-out. */
 static bool create_seed(void)
 {
     size_t cursor = 0;
@@ -2643,12 +2665,14 @@ static void show_new_seed_menu(void)
         if (selected < 0 || selected == 2) {
             return;
         }
-        /* A seed that made it all the way to Erase and exit (or a timeout) closes
-         * this menu too, straight back to the Origo/Home menu, rather than
-         * reopening "New Seed" - that reopening was the actual bug: pressing
-         * Erase and exit landed back inside New Seed instead of at Home. Backing
-         * out of the source/length picker before anything was generated
-         * keeps the old "one level up" behaviour. */
+        /* A seed that was generated closes this menu too, straight back to the
+         * Origo/Home menu, rather than reopening "New Seed" - that reopening
+         * was the actual bug: ending a session landed back inside New Seed
+         * instead of at Home. Leaving the wallet viewer now reboots, which
+         * settles that case before it gets here; what is left for this to
+         * handle is the viewer failing to open at all. Backing out of the
+         * source/length picker before anything was generated keeps the old
+         * "one level up" behaviour. */
         if (selected == 0 ? create_seed() : complete_checksum()) {
             return;
         }

main/seedtool_render.c

@@ -486,7 +486,7 @@ void seedtool_render_list(const char* title, const char* const* items, const siz
         const bool highlighted = top + row == selected;
         const int y = LIST_TOP + (int)row * LIST_ROW_HEIGHT;
         /* The last row of every list is the way out of it — Back, Erase and
-         * exit, [delete]. A rule above it lifts it out of the choices,
+         * restart, [delete]. A rule above it lifts it out of the choices,
          * which is what it is not. It goes in the gap between cells so the
          * selection bar never paints over it. */
         if (top + row == count - 1 && count > 1) {