Improve error handling / RSOD screen

[cepetr]

This PR improves error handling in both C and Rust code:

and finally saves about 12KB of FLASH (without affecting the functionality)

1. Multiple implementations of error handling code were removed from common.c/common.h and moved to the platform-independent lib/error_handling.h/.c.
2. Duplicated code, especially in the simulator, was removed and replaced by calls to error_shutdown().
3. Fixed invalid footer text in show_pin_too_many_screen() and show_wipe_code_screen().
4. Simplified the interface of error_shutdown() and introduced error_shutdown_ex() for more complex cases.
5. Replaced calls to __fatal_error() with error_shutdown() as the former is low-level and private to error_handling.c.
6. Moved show_install_restricted_screen() to a more appropriate location (from secret.c to error_handling.c).
7. Final error handling for Bootloader/Firmware is now done in Rust in the error_shutdown() function, eliminating dual implementations in Rust and C.
8. Fixed the problem with nested calls to render_on_display when an error occurred during drawing on the T3T1 model.
9. Introduced the dbg_trace! macro, a print!-like macro for printing to the debug console.
10. Added missing error locations in console output when raising ensure!, unwrap!, and fatal_error!.
11. Replaced calls to panic! by calls to fatal_error!. fatal_error! has now just single parameter - message
12. Redefined assert() and ensure() macro to not print evaluated expression and filename with full path.
13. Also finally fixed Cleanup error_shutdown vs ensure(secfalse,msg) #744

IMPORTANT: Unfortunately, (12) triggered a wave of changes in storage and legacy code, just because of the shared prototype of __fatal_error(). All affected code was changed appropriately, and as a result, the T1 model no longer reports the expression and function name on the fatal error screen (there's just the file and line - which is still more than on other models).

[github-actions]

core UI changes	device test	click test	persistence test
T2T1 Model T	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
T2B1 Safe 3	test(screens) main(screens)	test(screens) main(screens)	2724
T3T1	test(screens) main(screens)	test(screens) main(screens)	test(screens) main(screens)
All	main(screens)

[matejcik]

very nice. OK from me, someone else should also look at it from embedded POV.

while you're at this, maybe you would like to look at #744 ? (not required for this PR but it might be an opportunity to fold it in)

[cepetr]

while you're at this, maybe you would like to look at #744 ? (not required for this PR but it might be an opportunity to fold it in)

It looks like error_shutdown(..) can now perfectly replace the ensure(secfalse, ...) macro. The thing to consider is that we will lose file and line information in debug builds. If this is not a problem (and I think it isn't since all these ensure(secfalse instances contain quite unique messages), I can make this change within this PR. Should I? @matejcik

[matejcik]

f this is not a problem (and I think it isn't since all these ensure(secfalse instances contain quite unique messages)

yeah, exactly.
please go ahead and do it

[cepetr]

f this is not a problem (and I think it isn't since all these ensure(secfalse instances contain quite unique messages)

yeah, exactly. please go ahead and do it

I made the changes in commit af45de2:

1. In the storage, I've replaced ensure(secfalse with handle_fault.
2. In the storage tests, I've left it unchanged.
3. I've also change it Ii the display/i2c drivers, but we should not call it at all and return with an error instead. However, this is not related to this PR.

@matejcik

[matejcik]

i don't think that is correct, as handle_fault will additionally bump the fault counter, which makes no sense in that location (we wiped the storage right before)

Aaaa, I didn't notice that. So I reverted this change here. In this file, it seems better to be consistent and not introduce a call to error_shutdown. See 8b23004

[matejcik]

Aaaa, I didn't notice that. So I reverted this change here. In this file, it seems better to be consistent and not introduce a call to error_shutdown. See 8b23004

it's helpful if you post in your own comment, instead of editing mine :)

otherwise, all good from my side