WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

update_disk: use wc_ForceZero() in the DISK_ENCRYPT helpers 

ForceZero() is only visible in libwolfboot.c, which pulls in misc.c
inline; update_disk.c called it without a declaration, so any config with
disk encryption failed to build. Use the exported wc_ForceZero() from
memory.o instead, which is always linked.

Add a zynqmp_sdcard ENCRYPT build job to CI, the only one that compiles
these paths.
pull/851/head
Daniele Lacamera 2026-08-11 13:24:32 +02:00
parent f9fe1386ac
commit 4726dce42b
4 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/test-configs.yml vendored
View File

@ -784,6 +784,14 @@ jobs:
arch: aarch64
config-file: ./config/examples/zynqmp_sdcard.config
# Only build that compiles the DISK_ENCRYPT paths of src/update_disk.c.
zynqmp_sdcard_encrypt_test:
uses: ./.github/workflows/test-build-aarch64.yml
with:
arch: aarch64
config-file: ./config/examples/zynqmp_sdcard.config
make-args: ENCRYPT=1 ENCRYPT_WITH_AES256=1
zynqmp_fsbl_test:
uses: ./.github/workflows/test-build-aarch64.yml
with:

7
src/update_disk.c
View File

@ -56,6 +56,7 @@
defined(ENCRYPT_WITH_CHACHA)
#define DISK_ENCRYPT
#include "encrypt.h"
#include <wolfssl/wolfcrypt/memory.h> /* wc_ForceZero */
/* Module-level storage for encryption nonce */
static uint8_t disk_encrypt_nonce[ENCRYPT_NONCE_SIZE];
@ -235,13 +236,13 @@ static int decrypt_header(const uint8_t *src, uint8_t *dst)
static void disk_crypto_clear(void)
{
ForceZero(disk_encrypt_key, sizeof(disk_encrypt_key));
ForceZero(disk_encrypt_nonce, sizeof(disk_encrypt_nonce));
wc_ForceZero(disk_encrypt_key, sizeof(disk_encrypt_key));
wc_ForceZero(disk_encrypt_nonce, sizeof(disk_encrypt_nonce));
}
static void disk_decrypted_header_clear(uint8_t *hdr)
{
ForceZero(hdr, IMAGE_HEADER_SIZE);
wc_ForceZero(hdr, IMAGE_HEADER_SIZE);
}
#endif /* DISK_ENCRYPT */

2
tools/unit-tests/unit-update-disk-fit.c
View File

@ -136,7 +136,7 @@ int wc_Chacha_Process(ChaCha* ctx, byte* output, const byte* input, word32 msgle
return 0;
}
void ForceZero(void* mem, size_t len)
void wc_ForceZero(void* mem, size_t len)
{
volatile uint8_t *p = (volatile uint8_t *)mem;
while (len-- > 0) {

2
tools/unit-tests/unit-update-disk.c
View File

@ -108,7 +108,7 @@ int wc_Chacha_Process(ChaCha* ctx, byte* output, const byte* input, word32 msgle
return 0;
}
void ForceZero(void* mem, size_t len)
void wc_ForceZero(void* mem, size_t len)
{
volatile uint8_t *p = (volatile uint8_t *)mem;
while (len-- > 0) {