mirror of https://github.com/wolfSSL/wolfBoot.git
Remove tracker ids from code, condense comments
Drop the internal report numbers from source, test and Makefile comments: they mean nothing outside the tracker and do not belong in the tree. Condense the long inline comment blocks the review flagged, and note in the raspi3 encrypted example and its docs that CI builds but does not boot it, so the end-to-end path has no automated coverage. Comments and docs only; no functional change.pull/862/head
Daniele Lacamera
parent
52a1b085e0
commit
57db8948d1
|
|
@ -1,7 +1,8 @@
|
|||
# NOTE: the raspi3 HAL no longer ships a hardcoded test encryption key.
|
||||
# Nothing in this target calls wolfBoot_set_encrypt_key(), so an image
|
||||
# built with this config will reject encrypted updates until a key is
|
||||
# provisioned. See "Testing with kernel encryption" in docs/Targets.md.
|
||||
# NOTE: no hardcoded test key ships with the raspi3 HAL any more, and
|
||||
# nothing in this target calls wolfBoot_set_encrypt_key(), so this build
|
||||
# rejects encrypted updates until a key is provisioned. CI builds this
|
||||
# config but does not boot it. See "Testing with kernel encryption" in
|
||||
# docs/Targets.md.
|
||||
ARCH?=AARCH64
|
||||
TARGET?=raspi3
|
||||
SIGN?=RSA4096
|
||||
|
|
|
|||
|
|
@ -3760,17 +3760,18 @@ printf "0123456789abcdef0123456789abcdef0123456789ab" > /tmp/enc_key.der
|
|||
|
||||
* Provision the same key into the bootloader
|
||||
|
||||
The raspi3 HAL does not ship a hardcoded key: `hal_init()` used to call
|
||||
`wolfBoot_set_encrypt_key()` with a fixed test key compiled into the
|
||||
image, which meant every build shared one publicly known secret. It was
|
||||
removed, so the bootloader now has no key until one is provisioned and
|
||||
encrypted updates fail closed.
|
||||
The raspi3 HAL no longer ships a hardcoded key, so the bootloader has
|
||||
none until one is provisioned and encrypted updates fail closed. To run
|
||||
this demo, call `wolfBoot_set_encrypt_key()` with the key and nonce from
|
||||
the file above at the end of `hal_init()` in `hal/raspi3.c`. That is a
|
||||
development-only shortcut; a real deployment provisions a per-device key
|
||||
from outside the firmware image (see
|
||||
[encrypted_partitions.md](encrypted_partitions.md)).
|
||||
|
||||
To run this demo, call `wolfBoot_set_encrypt_key()` with the 32-byte key
|
||||
and 12-byte nonce from the file above at the end of `hal_init()` in
|
||||
`hal/raspi3.c`. That is a development-only shortcut: a real deployment
|
||||
must provision a per-device key from a source that is not in the
|
||||
firmware image (see [encrypted_partitions.md](encrypted_partitions.md)).
|
||||
Note that CI builds this example but does not boot it, so the end-to-end
|
||||
encrypted path above is not covered by an automated test. Adding runtime
|
||||
coverage would need a provisioning hook the target does not currently
|
||||
have.
|
||||
|
||||
* Sign and encrypt Linux kernel image
|
||||
```
|
||||
|
|
|
|||
|
|
@ -521,10 +521,9 @@ void xspi_read_sr(uint8_t* rxbuf, uint32_t addr, uint32_t len)
|
|||
}
|
||||
|
||||
/* Block until the NOR device finishes its program/erase cycle.
|
||||
* XSPI_IPCMDDONE only reports that the controller finished driving the
|
||||
* sequence on the bus; the device keeps WIP set for the ~ms the cycle
|
||||
* takes, and ignores Write Enable and further program/erase commands
|
||||
* until it clears. */
|
||||
* XSPI_IPCMDDONE only means the controller finished driving the bus;
|
||||
* the device keeps WIP set for the ~ms the cycle takes and ignores
|
||||
* Write Enable until it clears. */
|
||||
void xspi_wait_ready(uint32_t addr)
|
||||
{
|
||||
uint8_t status[4] = {0, 0, 0, 0};
|
||||
|
|
@ -613,8 +612,8 @@ void xspi_flash_write(uintptr_t address, const uint8_t *data, uint32_t len)
|
|||
XSPI_IPTXFCR = XSPI_IPRCFCR_FLUSH;
|
||||
XSPI_INTR = XSPI_IPCMDDONE;
|
||||
|
||||
/* The program cycle is still running: the next iteration's
|
||||
* Write Enable would be ignored and its Page Program dropped. */
|
||||
/* Else the next iteration's Write Enable is ignored and its
|
||||
* Page Program dropped. */
|
||||
xspi_wait_ready(address);
|
||||
|
||||
len -= size;
|
||||
|
|
|
|||
|
|
@ -196,12 +196,10 @@
|
|||
#define ELBC_FBAR ((volatile uint32_t*)(ELBC_BASE + 0xEC)) /* flash address register - OR_PGS=0 (shift 5), OR_PGS=1 (shift 6) */
|
||||
#define ELBC_FPAR ((volatile uint32_t*)(ELBC_BASE + 0xF0)) /* flash page address register */
|
||||
#define ELBC_FBCR ((volatile uint32_t*)(ELBC_BASE + 0xF4)) /* flash byte count register */
|
||||
/* FBCR[BC] = byte count: 0 = full page + spare, the only setting that
|
||||
* generates/checks ECC (FPAR[MS] and FPAR[CI] are then treated as 0);
|
||||
* otherwise the number of bytes transferred starting at FPAR[CI].
|
||||
* P1021RM 12.3.30 numbers it bits 20-31 MSB-first, i.e. the low 12 bits
|
||||
* of the word -- unshifted, like ELBC_FPAR_*_CI below. Bits 0-19 are
|
||||
* reserved. */
|
||||
/* FBCR[BC] = byte count: 0 = full page + spare (the only ECC setting,
|
||||
* FPAR[MS]/[CI] then read as 0), else bytes from FPAR[CI]. P1021RM
|
||||
* 12.3.30 numbers it 20-31 MSB-first, i.e. the low 12 bits: unshifted,
|
||||
* like ELBC_FPAR_*_CI below. */
|
||||
#define ELBC_FBCR_BC(n) ((n) & 0xFFF)
|
||||
|
||||
#define ELBC_LTESR ((volatile uint32_t*)(ELBC_BASE + 0xB0)) /* transfer error status register */
|
||||
|
|
@ -685,10 +683,9 @@ static int hal_flash_command(uint8_t iswrite)
|
|||
|
||||
ltesr = get32(ELBC_LTESR);
|
||||
|
||||
/* Test the completion flag rather than the loop counter: on a
|
||||
* timeout exit "timeout" has already been incremented past
|
||||
* FLASH_TIMEOUT_TRIES, so the old "timeout == FLASH_TIMEOUT_TRIES"
|
||||
* never matched and a command that never completed returned 0. */
|
||||
/* Test the completion flag, not the loop counter: on a timeout exit
|
||||
* "timeout" has already passed FLASH_TIMEOUT_TRIES, so comparing it
|
||||
* for equality never matched and a hung command returned 0. */
|
||||
if (!(ltesr & ELBC_LTESR_CC)) {
|
||||
ret = -1;
|
||||
}
|
||||
|
|
@ -700,11 +697,9 @@ static int hal_flash_command(uint8_t iswrite)
|
|||
return ret;
|
||||
}
|
||||
|
||||
/* Uses 32-bit accesses only when both the FCM window offset and the
|
||||
* caller's buffer are 4-byte aligned: flash_idx starts at the page
|
||||
* column and the chunk lengths need not be multiples of 4, so either
|
||||
* side can be odd. A misaligned 32-bit access to the cache-inhibited,
|
||||
* guarded eLBC window raises an alignment interrupt on e500. */
|
||||
/* 32-bit accesses only when both the FCM offset and the caller's
|
||||
* buffer are 4-byte aligned; either can be odd, and a misaligned
|
||||
* access to the guarded eLBC window traps on e500. */
|
||||
static void hal_flash_read_bytes(uint8_t* data, size_t len)
|
||||
{
|
||||
uint32_t end = flash_idx + (uint32_t)len;
|
||||
|
|
@ -1758,12 +1753,9 @@ int ext_flash_read(uintptr_t address, uint8_t *data, int len)
|
|||
/* read page into FCM buffer */
|
||||
hal_flash_set_addr(page, col);
|
||||
|
||||
/* Always transfer the full page + spare (BC = 0). It is the
|
||||
* only setting that checks ECC, and the bad-block marker
|
||||
* tested below lives in the spare region, which a BC != 0
|
||||
* transfer never loads -- the check would then sample stale
|
||||
* FCM RAM. read_size still governs how much is copied out
|
||||
* of the buffer and how far the loop advances. */
|
||||
/* Always full page + spare (BC = 0): the bad-block marker
|
||||
* below lives in the spare region, which a BC != 0 transfer
|
||||
* never loads. read_size still bounds the copy out. */
|
||||
set32(ELBC_FBCR, 0);
|
||||
|
||||
ret = hal_flash_command(0);
|
||||
|
|
|
|||
|
|
@ -2093,7 +2093,7 @@ static int qe_check_firmware(const struct qe_firmware *firmware, const char* t)
|
|||
/* The microcode must lie inside the declared image: the upload
|
||||
* reads code_offset + 4*count bytes from the firmware start, so an
|
||||
* out-of-image offset would copy arbitrary memory into QE IRAM and
|
||||
* program arbitrary traps (F-8000). 64-bit so the sum cannot wrap. */
|
||||
* program arbitrary traps. 64-bit so the sum cannot wrap. */
|
||||
for (i = 0; i < firmware->count; i++) {
|
||||
mcode_end = (uint64_t)firmware->microcode[i].code_offset +
|
||||
(uint64_t)4 * firmware->microcode[i].count;
|
||||
|
|
@ -3534,11 +3534,9 @@ int hal_dts_fixup(void* dts_addr)
|
|||
break;
|
||||
cell = fdt32_to_cpu(*reg);
|
||||
|
||||
/* Translate the DTS cell-index into a phydevs slot before
|
||||
* touching the table. NXP's qoriq-fman3 dtsi numbers the 1G
|
||||
* memacs 0..3 and the 10G memacs 0x8/0x9, while phydevs holds
|
||||
* the 1G ports at 0..3 and the single 10G port at FM1_10GEC1.
|
||||
* Anything with no slot is skipped rather than indexed. */
|
||||
/* NXP's qoriq-fman3 dtsi numbers the 1G memacs 0..3 and the
|
||||
* 10G memacs 0x8/0x9; phydevs holds 1G at 0..3 and the single
|
||||
* 10G port at FM1_10GEC1. Skip anything with no slot. */
|
||||
if (cell <= FM1_DTSEC4)
|
||||
i = (int)cell;
|
||||
else if (cell == 8)
|
||||
|
|
|
|||
|
|
@ -663,10 +663,8 @@ static int hal_fman_init(void)
|
|||
return -1;
|
||||
}
|
||||
|
||||
/* Everything below reads through fw. The guard above only proved
|
||||
* that FMAN_FW_ADDR itself is inside the NOR window, so bound the
|
||||
* fixed part of the container (header + first microcode entry)
|
||||
* before dereferencing any of it. */
|
||||
/* The guard above only proved FMAN_FW_ADDR itself is in the NOR
|
||||
* window; bound the fixed part before dereferencing it. */
|
||||
fw_off = (uint64_t)((uintptr_t)fw - (uintptr_t)FLASH_BASE_ADDR);
|
||||
extent = (uint64_t)FLASH_BANK_SIZE - fw_off;
|
||||
if (extent < (uint64_t)sizeof(struct qe_firmware)) {
|
||||
|
|
@ -685,7 +683,7 @@ static int hal_fman_init(void)
|
|||
* microcode count, self-consistent length, every code range inside
|
||||
* the declared image, and the whole image inside the remaining NOR
|
||||
* bank. 64-bit arithmetic so the sums cannot wrap. Fail closed:
|
||||
* FMan stays unconfigured on any mismatch (F-9762). */
|
||||
* FMan stays unconfigured on any mismatch. */
|
||||
if (hdr->version != 1) {
|
||||
wolfBoot_printf("FMAN: version %d unsupported\n", hdr->version);
|
||||
return -1;
|
||||
|
|
@ -701,9 +699,8 @@ static int hal_fman_init(void)
|
|||
uint64_t calc;
|
||||
unsigned int k;
|
||||
|
||||
/* Bound the microcode table and the declared image against the
|
||||
* NOR before either is walked -- the table sits past the fixed
|
||||
* part checked above, and the loop below dereferences it. */
|
||||
/* Bound the table and the declared image before walking
|
||||
* them: the table sits past the fixed part checked above. */
|
||||
if (table > extent || length > extent) {
|
||||
wolfBoot_printf("FMAN: image %lu exceeds NOR extent %lu\n",
|
||||
(unsigned long)length, (unsigned long)extent);
|
||||
|
|
|
|||
|
|
@ -90,9 +90,8 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
|
|||
|
||||
#if TZ_SECURE()
|
||||
if (address >= FLASH_BANK2_BASE)
|
||||
/* Claim the flash span the program touches: the last partial
|
||||
* double word is read back and programmed whole, up to the
|
||||
* 8-byte boundary past len. */
|
||||
/* The last partial double word is programmed whole, so
|
||||
* claim up to the 8-byte boundary past len. */
|
||||
hal_tz_claim_nonsecure_area(address, (len + 7) & ~7);
|
||||
/* Convert into secure address space */
|
||||
dst = (uint32_t *)((address & (~FLASHMEM_ADDRESS_SPACE)) | FLASH_SECURE_MMAP_BASE);
|
||||
|
|
@ -101,13 +100,9 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
|
|||
while (i < len) {
|
||||
int j;
|
||||
|
||||
/* Build the whole 64-bit unit before opening the PG window.
|
||||
* The flash has no 32-bit program mode: both words of the
|
||||
* double word must be stored inside one PG window or the
|
||||
* operation never starts. Bytes outside [i, len) are read back
|
||||
* from flash and written unchanged, so nothing past the
|
||||
* requested length is modified and the source is never read
|
||||
* past len (same read-modify-write shape as hal/stm32h5.c). */
|
||||
/* Read-modify-write the whole 64-bit unit (as stm32h5.c):
|
||||
* there is no 32-bit program mode, so both words must be
|
||||
* stored inside one PG window or nothing is programmed. */
|
||||
for (j = 0; j < 8; j++) {
|
||||
if (i + j < len)
|
||||
dword_bytes[j] = data[i + j];
|
||||
|
|
|
|||
|
|
@ -140,10 +140,9 @@ octospi_err:
|
|||
|
||||
static int RAMFUNCTION octospi_write_enable(void)
|
||||
{
|
||||
/* A failed WREN leaves the write-enable latch clear: the device then
|
||||
* silently ignores the program/erase that follows, never goes BUSY, and
|
||||
* octospi_wait_ready() reports idle on its first poll. The command must
|
||||
* fail the operation instead of being discarded. */
|
||||
/* A failed WREN leaves the latch clear: the device then ignores the
|
||||
* program/erase, never goes BUSY, and octospi_wait_ready() reports
|
||||
* idle on its first poll. */
|
||||
return octospi_cmd(0, WRITE_ENABLE_CMD, 0, SPI_MODE_NONE,
|
||||
NULL, 0, SPI_MODE_NONE, 0);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -95,14 +95,9 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
|
|||
while (i < len) {
|
||||
int j;
|
||||
|
||||
/* Build the whole 128-bit unit before opening the PG window.
|
||||
* The controller only starts the program once all four words
|
||||
* have been stored -- a partial quad-word leaves FLASH_SR_WDW
|
||||
* set and hal_flash_wait_complete() never returns. Bytes
|
||||
* outside [i, len) are read back from flash and written
|
||||
* unchanged, so nothing past the requested length is modified
|
||||
* and the source is never read past len (same read-modify-write
|
||||
* shape as hal/stm32h5.c). */
|
||||
/* Read-modify-write the whole 128-bit unit (as stm32h5.c):
|
||||
* the program only starts on the 4th word, and a partial
|
||||
* quad-word leaves FLASH_SR_WDW set, hanging the wait. */
|
||||
for (j = 0; j < 16; j++) {
|
||||
if (i + j < len)
|
||||
qword_bytes[j] = data[i + j];
|
||||
|
|
|
|||
|
|
@ -147,9 +147,8 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
|
|||
* (aligned) block; len < WRITE_BLOCK_SIZE keeps it to one more */
|
||||
if (st == 0 && (uint32_t)len > first) {
|
||||
/* The first program is still in flight: the FSM rejects a
|
||||
* second command while busy, and a read from a bank under
|
||||
* program returns undefined data -- which the read-modify-
|
||||
* write below would then stage and program. */
|
||||
* command while busy, and reading a bank under program
|
||||
* returns undefined data. */
|
||||
while(FAPI_CHECK_FSM_READY_BUSY != Fapi_Status_FsmReady)
|
||||
;
|
||||
memcpy(temp, (void*)(address + first), WRITE_BLOCK_SIZE);
|
||||
|
|
|
|||
|
|
@ -237,9 +237,9 @@ static int open_kernel_image(EFI_FILE_HANDLE vol, CHAR16 *filename,
|
|||
UINTN pages;
|
||||
UINT64 filesz;
|
||||
|
||||
/* Always leave *_addr well-defined so the caller's "no image" check is
|
||||
* reliable: 0 on any failure, the loaded address only on full success.
|
||||
* (F-9738) */
|
||||
/* Always leave *_addr well-defined so the caller's "no image" check
|
||||
* is reliable: 0 on any failure, the loaded address only on full
|
||||
* success. */
|
||||
*_addr = 0;
|
||||
*sz = 0;
|
||||
file = openFile(filename, vol);
|
||||
|
|
|
|||
|
|
@ -2033,12 +2033,10 @@ static int RAMFUNCTION hal_set_key(const uint8_t *k, const uint8_t *nonce)
|
|||
ret = hal_flash_erase(addr_align, WOLFBOOT_SECTOR_SIZE);
|
||||
#endif
|
||||
exit_lock:
|
||||
/* The raw key and nonce were staged in ENCRYPT_CACHE above. Scrub it
|
||||
* on every build where wolfBoot owns the buffer: the two static
|
||||
* cases -- NVM_FLASH_WRITEONCE aliases ENCRYPT_CACHE to NVM_CACHE,
|
||||
* WOLFBOOT_SMALL_STACK gives it its own static array -- are exactly
|
||||
* the ones where the plaintext would otherwise stay resident for the
|
||||
* rest of the boot. Only a caller-supplied buffer is left alone. */
|
||||
/* Scrub the staged key/nonce on every build where wolfBoot owns the
|
||||
* buffer. The static cases (NVM_FLASH_WRITEONCE aliases it to
|
||||
* NVM_CACHE, WOLFBOOT_SMALL_STACK has its own array) are exactly
|
||||
* where the plaintext would otherwise stay resident. */
|
||||
#if !defined(WOLFBOOT_ENCRYPT_CACHE)
|
||||
ForceZero(ENCRYPT_CACHE, NVM_CACHE_SIZE);
|
||||
#endif
|
||||
|
|
@ -2945,7 +2943,7 @@ int wolfBoot_ram_decrypt(uint8_t *src, uint8_t *dst)
|
|||
* permission bits are deliberately not required, as they read back as 0 when the
|
||||
* NS MPU is disabled (NO_MPU) and do not constrain Secure accesses to NS memory
|
||||
* anyway. Outside a CMSE secure build there is no security boundary, so the check
|
||||
* collapses to a non-NULL pass-through. Same fix pattern as F-4416/F-4417/F-4644. */
|
||||
* collapses to a non-NULL pass-through. Same fix pattern as earlier reports. */
|
||||
#if defined(__ARM_FEATURE_CMSE) && (__ARM_FEATURE_CMSE == 3U)
|
||||
#include <arm_cmse.h>
|
||||
#define WOLFBOOT_NSC_NS_RW(p, sz) \
|
||||
|
|
|
|||
13
src/sdhci.c
13
src/sdhci.c
|
|
@ -65,9 +65,8 @@ int __attribute__((weak)) sdhci_platform_block_copy(
|
|||
}
|
||||
#endif
|
||||
|
||||
/* Watchdog service hook. Not tied to SDHCI_BLOCK_VIA_PDMA: the bounded
|
||||
* busy waits call it on every build, and a platform with a hardware
|
||||
* watchdog overrides it. */
|
||||
/* Watchdog service hook, called by the bounded busy waits on every
|
||||
* build. A platform with a hardware watchdog overrides it. */
|
||||
void __attribute__((weak)) sdhci_platform_wdt_pet(void)
|
||||
{
|
||||
}
|
||||
|
|
@ -438,10 +437,8 @@ static void sdhci_uhs_recover_rollback(void)
|
|||
{
|
||||
wolfBoot_printf("SDHCI: 1.8V retry failed, restoring 3.3V signaling\n");
|
||||
|
||||
/* Roll the one-shot back with the registers: leaving it set would
|
||||
* put the host in a state the base code could not reach -- back at
|
||||
* 3.3V but with the recovery spent -- so a genuinely UHS-I card
|
||||
* could never be retried for the rest of the boot. */
|
||||
/* Roll the one-shot back with the registers: back at 3.3V with the
|
||||
* recovery spent, a real UHS-I card could never be retried. */
|
||||
g_uhs_recovered = 0;
|
||||
|
||||
sdhci_reg_and(SDHCI_SRS11, ~SDHCI_SRS11_SDCE);
|
||||
|
|
@ -630,7 +627,7 @@ int sdhci_cmd(uint32_t cmd_index, uint32_t cmd_arg, uint8_t resp_type)
|
|||
|
||||
/* Worst-case programming time (erase) in milliseconds. Finite, so a
|
||||
* removed card or a card stuck in the programming state fails with an
|
||||
* I/O error instead of spinning forever (F-7984). The budget is sized
|
||||
* I/O error instead of spinning forever. The budget is sized
|
||||
* for an erase because sdhci_wait_busy() is the wait after every R1b
|
||||
* command, erase included; the watchdog is serviced inside both loops
|
||||
* so a long wait cannot turn into a reset. */
|
||||
|
|
|
|||
|
|
@ -828,7 +828,7 @@ unit-zynq-erase-loop: unit-zynq-erase-loop.c zynq_erase_extract.h
|
|||
gcc -o $@ unit-zynq-erase-loop.c $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-zynq-ext-write runs the real ext_flash_write() from hal/zynq.c
|
||||
# (F-7979: page chunks crossed physical NOR page boundaries and the
|
||||
# (page chunks crossed physical NOR page boundaries and the
|
||||
# wrap clobbered the page start). Same extraction approach as the
|
||||
# erase test; the emulated NOR models the wrap.
|
||||
zynq_write_extract.h: ../../hal/zynq.c
|
||||
|
|
@ -838,7 +838,7 @@ unit-zynq-ext-write: unit-zynq-ext-write.c zynq_write_extract.h
|
|||
gcc -o $@ unit-zynq-ext-write.c $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-versal-qspi-dma drives the real DMA RX path of qspi_transfer() in
|
||||
# hal/versal.c (F-7982: an unaligned read larger than the 4096-byte
|
||||
# hal/versal.c (an unaligned read larger than the 4096-byte
|
||||
# temp buffer copied the full requested length out of the buffer). The
|
||||
# generated host copies differ from the real files only in:
|
||||
# - ARM asm statements blanked (cannot assemble on x86; the cache
|
||||
|
|
@ -880,7 +880,7 @@ unit-versal-qspi-dma: unit-versal-qspi-dma.c versal_host.c
|
|||
gcc -o $@ unit-versal-qspi-dma.c -DTARGET_versal -DEXT_FLASH -DARCH_AARCH64 -DARCH_64BIT $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-versal-ext-write runs the real ext_flash_write() from
|
||||
# hal/versal.c (F-7981: page chunks crossed physical NOR page
|
||||
# hal/versal.c (page chunks crossed physical NOR page
|
||||
# boundaries and the wrap clobbered the page start). The QspiDev_t
|
||||
# struct and the function are extracted verbatim (the qspi_* helpers
|
||||
# are file-static, so the test provides emulated ones); the emulated
|
||||
|
|
@ -895,7 +895,7 @@ unit-versal-ext-write: unit-versal-ext-write.c versal_qspidev_extract.h versal_e
|
|||
gcc -o $@ unit-versal-ext-write.c -DEXT_FLASH -DARCH_AARCH64 -DARCH_64BIT $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-t10xx-qe-firmware runs the real qe_check_firmware() from
|
||||
# hal/nxp_t10xx.c (F-8000: the per-microcode code_offset was never
|
||||
# hal/nxp_t10xx.c (the per-microcode code_offset was never
|
||||
# bounded against the declared image, so a self-consistent blob could
|
||||
# make the upload copy arbitrary memory into QE IRAM). The qe_*
|
||||
# structures and the check function are extracted verbatim; the check
|
||||
|
|
@ -910,7 +910,7 @@ unit-t10xx-qe-firmware: unit-t10xx-qe-firmware.c t10xx_qe_firmware_extract.h
|
|||
gcc -o $@ unit-t10xx-qe-firmware.c -DWOLFBOOT_NO_PRINTF $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-aurix-erased-fill runs the real cacheSector() and
|
||||
# programBytesToErasedFlash() from hal/aurix_tc3xx.c (F-9737: the
|
||||
# programBytesToErasedFlash() from hal/aurix_tc3xx.c (the
|
||||
# uint32_t page buffers were filled with the byte-valued
|
||||
# FLASH_BYTE_ERASED, so default-polarity builds got 0x000000FF words
|
||||
# instead of the erased 0xFFFFFFFF). The tc3_flash_* API is emulated
|
||||
|
|
@ -927,7 +927,7 @@ unit-aurix-erased-fill-invert: unit-aurix-erased-fill.c aurix_erased_extract.h
|
|||
gcc -o $@ unit-aurix-erased-fill.c -DWOLFBOOT_FLAGS_INVERT $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-t2080-fman-loader runs the real hal_fman_init() from
|
||||
# hal/nxp_t2080.c (F-9762: the loader checked only the QEF magic and
|
||||
# hal/nxp_t2080.c (the loader checked only the QEF magic and
|
||||
# then copied attacker-shaped offsets/counts into FMan IRAM). The qe_*
|
||||
# structures and the function are extracted verbatim; the test owns the
|
||||
# NOR image (FMAN slot at a nonzero bank offset so the remaining-extent
|
||||
|
|
@ -942,7 +942,7 @@ unit-t2080-fman-loader: unit-t2080-fman-loader.c t2080_fman_extract.h
|
|||
gcc -o $@ unit-t2080-fman-loader.c $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-stm32l5-write runs the real hal_flash_write() from hal/stm32l5.c
|
||||
# (F-9763: an 8-byte program unit was read whole even when len left a
|
||||
# (an 8-byte program unit was read whole even when len left a
|
||||
# partial unit, over-reading the caller's buffer and writing the excess
|
||||
# bytes to flash). The function and its wait/clear helpers are
|
||||
# extracted verbatim; FLASH_SR/CR live on a host register file and the
|
||||
|
|
@ -956,8 +956,8 @@ stm32l5_write_extract.h: ../../hal/stm32l5.c
|
|||
unit-stm32l5-write: unit-stm32l5-write.c stm32l5_write_extract.h
|
||||
gcc -o $@ unit-stm32l5-write.c $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-stm32u5-write is the 16-byte-unit twin of the STM32L5 test
|
||||
# (F-9764): the real hal_flash_write() and its wait/clear helpers from
|
||||
# unit-stm32u5-write is the 16-byte-unit twin of the STM32L5 test:
|
||||
# the real hal_flash_write() and its wait/clear helpers from
|
||||
# hal/stm32u5.c, FLASH_NS_SR/CR on a host register file, destination
|
||||
# flash at a 32-bit host address, canary after the source buffer.
|
||||
stm32u5_write_extract.h: ../../hal/stm32u5.c
|
||||
|
|
@ -969,7 +969,7 @@ unit-stm32u5-write: unit-stm32u5-write.c stm32u5_write_extract.h
|
|||
gcc -o $@ unit-stm32u5-write.c $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-nvm-cache-scrub runs the real trailer_write() and
|
||||
# partition_magic_write() from src/libwolfboot.c (F-9765: under
|
||||
# partition_magic_write() from src/libwolfboot.c (under
|
||||
# NVM_FLASH_WRITEONCE the staged sector can hold the firmware
|
||||
# key/nonce, and the buffer was never scrubbed on return). The test
|
||||
# owns NVM_CACHE, stages a key-bearing sector image, and stubs the
|
||||
|
|
@ -983,7 +983,7 @@ unit-nvm-cache-scrub: unit-nvm-cache-scrub.c nvm_cache_scrub_extract.h
|
|||
gcc -o $@ unit-nvm-cache-scrub.c $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-sdhci-uhs-recover drives disk_read()'s UHS recovery path from the
|
||||
# real src/sdhci.c (F-9735: any read error permanently switched the host
|
||||
# real src/sdhci.c (any read error permanently switched the host
|
||||
# to 1.8V signaling with no rollback). sdhci_host.c (generated below) is
|
||||
# identical to the real file except the three `asm volatile` statements
|
||||
# are blanked (they cannot assemble on x86) and the real sdhci_read() is
|
||||
|
|
@ -1001,7 +1001,7 @@ unit-sdhci-uhs-recover: unit-sdhci-uhs-recover.c sdhci_host.c
|
|||
gcc -o $@ unit-sdhci-uhs-recover.c -DDISK_SDCARD $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-sdhci-wait-busy drives sdhci_wait_busy()'s DATA0/CMD13 loops
|
||||
# from the real src/sdhci.c (F-7984: neither loop had a timeout, so a
|
||||
# from the real src/sdhci.c (neither loop had a timeout, so a
|
||||
# stuck/removed card spun forever). The controller is scripted through
|
||||
# the host register file. SDHCI_WAIT_BUSY_TIMEOUT_MS is deliberately
|
||||
# NOT overridden: the test's timer stub steps 1ms per read so the
|
||||
|
|
@ -1010,7 +1010,7 @@ unit-sdhci-wait-busy: unit-sdhci-wait-busy.c sdhci_host.c
|
|||
gcc -o $@ unit-sdhci-wait-busy.c -DDISK_SDCARD -DWOLFBOOT_NO_PRINTF $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-ti-hercules-write runs the real hal_flash_write() staging logic
|
||||
# from hal/ti_hercules.c (F-9736: a short write crossing a block
|
||||
# from hal/ti_hercules.c (a short write crossing a block
|
||||
# boundary overran the staging buffer and lost the next block's bytes).
|
||||
# ti_hercules.c needs the TI FAPI vendor headers (board build tree) and
|
||||
# cannot be compiled on the host, but the bug is entirely in this
|
||||
|
|
@ -1029,7 +1029,7 @@ unit-ti-hercules-write: unit-ti-hercules-write.c ti_hercules_write_extract.h
|
|||
gcc -o $@ unit-ti-hercules-write.c $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-p1021-qe-firmware drives the real qe_upload_firmware() from
|
||||
# hal/nxp_p1021.c (F-9759 bounds part: microcode offsets/counts were
|
||||
# hal/nxp_p1021.c (microcode offsets/counts were
|
||||
# never bounded to the 64 KiB buffer read from the update partition).
|
||||
# Reuses the nxp_p1021_host.c generated for the FCM tests, with the
|
||||
# PowerPC accessors shadowed the same way.
|
||||
|
|
@ -1038,7 +1038,7 @@ unit-p1021-qe-firmware: unit-p1021-qe-firmware.c nxp_p1021_host.c
|
|||
gcc -o $@ unit-p1021-qe-firmware.c -DTARGET_nxp_p1021 -I../../hal $(CFLAGS) $(LDFLAGS)
|
||||
|
||||
# unit-t10xx-dts-memac drives the real hal_dts_fixup() FDT memac loop
|
||||
# (F-7052: unvalidated cell-index into phydevs[5]) with hand-built
|
||||
# (unvalidated cell-index into phydevs[5]) with hand-built
|
||||
# DTBs. Extracts the function plus its liodn/qman static tables from
|
||||
# hal/nxp_t10xx.c.
|
||||
nxp_t10xx_fixup_extract.h: ../../hal/nxp_t10xx.c
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-aurix-erased-fill.c
|
||||
*
|
||||
* Regression test for F-9737: cacheSector() and
|
||||
* Regression test: cacheSector() and
|
||||
* programBytesToErasedFlash() in hal/aurix_tc3xx.c filled their
|
||||
* uint32_t page buffers with the byte-valued FLASH_BYTE_ERASED, so in
|
||||
* the default (non-inverted) build every 32-bit word became
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-efi-x86-open-image.c
|
||||
*
|
||||
* Regression test for F-9734: open_kernel_image() in hal/x86_64_efi.c passed
|
||||
* Regression test: open_kernel_image() in hal/x86_64_efi.c passed
|
||||
* the caller's uint32_t *sz directly as the BufferSize argument of
|
||||
* EFI_FILE_PROTOCOL.Read(). That parameter is a UINTN, which is 64 bits on
|
||||
* x86-64, and the UEFI spec requires the firmware to write the number of
|
||||
|
|
@ -478,7 +478,7 @@ START_TEST(test_open_image_too_small)
|
|||
ck_assert_int_eq(ret, -1);
|
||||
ck_assert(canary_intact(&canary));
|
||||
|
||||
/* F-9738: a rejected load must not publish the allocated address, and
|
||||
/* a rejected load must not publish the allocated address, and
|
||||
* the pages plus the file handle must be released. */
|
||||
ck_assert_uint_eq(addr, 0);
|
||||
ck_assert_int_eq(mock_free_pages, 1);
|
||||
|
|
@ -488,9 +488,9 @@ END_TEST
|
|||
|
||||
/* A file larger than 4 GiB must be rejected before any allocation: the
|
||||
* loader's size type is uint32_t, and a 64-bit FileSize() truncated into
|
||||
* it would allocate and read a tiny fragment of the real image
|
||||
* (F-9739). The guard runs before AllocatePages, so nothing is
|
||||
* allocated and nothing must be freed. */
|
||||
* it would allocate and read a tiny fragment of the real image. The
|
||||
* guard runs before AllocatePages, so nothing is allocated and nothing
|
||||
* must be freed. */
|
||||
START_TEST(test_open_image_oversized_rejected)
|
||||
{
|
||||
sz_canary_t canary;
|
||||
|
|
@ -514,7 +514,7 @@ START_TEST(test_open_image_oversized_rejected)
|
|||
END_TEST
|
||||
|
||||
/* A failed Read() must not publish the allocated address, and must free
|
||||
* the pages and close the file (F-9738). */
|
||||
* the pages and close the file. */
|
||||
START_TEST(test_open_image_read_failure)
|
||||
{
|
||||
sz_canary_t canary;
|
||||
|
|
@ -541,7 +541,7 @@ START_TEST(test_open_image_read_failure)
|
|||
END_TEST
|
||||
|
||||
/* A failed allocation must not publish an address, and must close the
|
||||
* file (F-9738). */
|
||||
* file. */
|
||||
START_TEST(test_open_image_alloc_failure)
|
||||
{
|
||||
sz_canary_t canary;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-flash-write-cc26x2.c
|
||||
*
|
||||
* Regression test for F-6869: hal_flash_write() and hal_flash_erase() in
|
||||
* Regression test: hal_flash_write() and hal_flash_erase() in
|
||||
* hal/cc26x2.c discarded the Fapi status returned by FlashProgram() and
|
||||
* FlashSectorErase() and unconditionally returned 0, so a program or erase
|
||||
* that the flash controller rejected was reported to wolfBoot as a success.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-ls1028a-xspi-write.c
|
||||
*
|
||||
* Regression test for F-7977: hal_flash_write() and ext_flash_write() in
|
||||
* Regression test: hal_flash_write() and ext_flash_write() in
|
||||
* hal/nxp_ls1028a.c issue xspi_write_en() once before xspi_flash_write(),
|
||||
* but xspi_flash_write() issues one Page Program command per 256-byte
|
||||
* chunk when len > XSPI_IP_BUF_SIZE. NOR flash clears its
|
||||
|
|
@ -388,7 +388,7 @@ END_TEST
|
|||
* inside its loop, so it is not affected by this finding (and its SE
|
||||
* command encoding is a separate matter, not covered here).
|
||||
*
|
||||
* Suite for the F-7977 write path: */
|
||||
* Suite for the write path: */
|
||||
Suite *ls1028a_xspi_suite(void)
|
||||
{
|
||||
Suite *s = suite_create("ls1028a-xspi-write");
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-nvm-cache-scrub.c
|
||||
*
|
||||
* Regression test for F-9765: under NVM_FLASH_WRITEONCE the
|
||||
* Regression test: under NVM_FLASH_WRITEONCE the
|
||||
* partition-trailer read-modify-write helpers stage a full flash
|
||||
* sector into the file-scope buffer NVM_CACHE. In EXT_ENCRYPTED
|
||||
* builds that same sector is where the firmware key/nonce live
|
||||
|
|
|
|||
|
|
@ -1,8 +1,9 @@
|
|||
/* unit-p1021-fcm-bytes.c
|
||||
*
|
||||
* Regression test for F-7975 and F-7976 in hal/nxp_p1021.c.
|
||||
* Regression tests for the FCM byte helpers and page loops in
|
||||
* hal/nxp_p1021.c.
|
||||
*
|
||||
* F-7975: hal_flash_read_bytes() and hal_flash_write_bytes() loop on
|
||||
* hal_flash_read_bytes() and hal_flash_write_bytes() loop on
|
||||
* `while (flash_idx < len)`, comparing the FCM buffer index (which
|
||||
* hal_flash_set_addr() initializes to the page column, `flash_idx = col`)
|
||||
* against the caller's relative byte count. With col != 0:
|
||||
|
|
@ -17,7 +18,7 @@
|
|||
* The fix computes an absolute end (flash_idx + len) and copies exactly
|
||||
* len bytes, handling the tail byte-wise.
|
||||
*
|
||||
* F-7976: the ext_flash_write()/ext_flash_read() page loops size every
|
||||
* the ext_flash_write()/ext_flash_read() page loops size every
|
||||
* iteration from the total request length instead of the remaining
|
||||
* length, do not cap it to the page, and program ELBC_FBCR with the
|
||||
* column offset - so the byte-count field (FBCR[BC], P1021RM 12.3.30
|
||||
|
|
@ -84,7 +85,7 @@ static uint32_t g_ccsr_regs[0x200000 / sizeof(uint32_t)];
|
|||
#define get16(addr) (*(const volatile uint16_t *)(addr))
|
||||
#define set16(addr, v) (*(volatile uint16_t *)(addr) = (uint16_t)(v))
|
||||
#define get32(addr) (*(const volatile uint32_t *)(addr))
|
||||
/* set32 goes through a host hook so the F-7976 tests can log FBCR
|
||||
/* set32 goes through a host hook so the tests can log FBCR
|
||||
* writes and emulate the FCM<->NAND data move the hardware performs on
|
||||
* an LSOR write (see p1021_set32() below). */
|
||||
static void p1021_set32(volatile uint32_t *addr, uint32_t v);
|
||||
|
|
@ -153,11 +154,11 @@ static uint8_t g_fcm8k[8 * 1024];
|
|||
* (see there for the single mechanical difference). */
|
||||
#include "nxp_p1021_host.c"
|
||||
|
||||
/* Stand-in FCM buffer for the F-7975 helper tests (they drive
|
||||
/* Stand-in FCM buffer for the helper tests (they drive
|
||||
* flash_buf directly, without hal_flash_set_addr()). */
|
||||
static uint8_t fcm[1024];
|
||||
|
||||
/* ---- F-7976: emulated NAND and FCM transfer hook ----
|
||||
/* ---- emulated NAND and FCM transfer hook ----
|
||||
*
|
||||
* The hardware moves data between the FCM buffer and the NAND page when
|
||||
* hal_flash_command() writes the LSOR register. On the host that write
|
||||
|
|
@ -274,7 +275,7 @@ START_TEST(test_write_col_zero)
|
|||
}
|
||||
END_TEST
|
||||
|
||||
/* The core F-7975 case: with col != 0 and len <= col the pre-fix loop
|
||||
/* The core case: with col != 0 and len <= col the pre-fix loop
|
||||
* ran zero times and the page program went ahead with stale FCM
|
||||
* contents. All len bytes must land at FCM offset col. */
|
||||
START_TEST(test_write_len_le_col)
|
||||
|
|
@ -386,7 +387,7 @@ START_TEST(test_read_len_gt_col)
|
|||
}
|
||||
END_TEST
|
||||
|
||||
/* ---- F-7976: ext_flash_write()/ext_flash_read() page loops ---- */
|
||||
/* ---- ext_flash_write()/ext_flash_read() page loops ---- */
|
||||
|
||||
/* A full-page write from column 0 must keep BC = 0 (full page + spare,
|
||||
* the only ECC-generating setting). */
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-p1021-qe-firmware.c
|
||||
*
|
||||
* Regression test for F-9759 (bounds part): qe_upload_firmware() in
|
||||
* Regression test (bounds part): qe_upload_firmware() in
|
||||
* hal/nxp_p1021.c validated only the self-declared consistency of the
|
||||
* QE microcode blob (magic, version, count range, length == computed
|
||||
* size, optional CRC32). The per-microcode code_offset/count fields and
|
||||
|
|
@ -10,7 +10,7 @@
|
|||
* code_offset or word count made the upload loop read (and copy into
|
||||
* QE instruction RAM) arbitrarily far past the buffer.
|
||||
*
|
||||
* Note: the full F-9759 recommendation also calls for cryptographic
|
||||
* Note: the full recommendation also calls for cryptographic
|
||||
* authentication of the microcode before activation. That is a design
|
||||
* decision (keys, signed manifest, build flow) beyond a minimal patch
|
||||
* and is tracked as a note on the finding; this test covers the
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-sdhci-uhs-recover.c
|
||||
*
|
||||
* Regression test for F-9735: disk_read() called sdhci_uhs_recover()
|
||||
* Regression test: disk_read() called sdhci_uhs_recover()
|
||||
* after any nonzero status from a data transfer, which permanently
|
||||
* switched the host to 1.8V signaling (SDHCI_SRS15_V18SE) on a plain
|
||||
* 3.3V cold boot whenever the first transfer failed for any reason
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-sdhci-wait-busy.c
|
||||
*
|
||||
* Regression test for F-7984: sdhci_wait_busy() had no timeout in
|
||||
* Regression test: sdhci_wait_busy() had no timeout in
|
||||
* either its DATA0 polling loop or its repeated CMD13 loop (the
|
||||
* in-code TODO acknowledged it). A removed card, a controller fault,
|
||||
* or a card stuck in the programming state left wolfBoot spinning
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-stm32l5-write.c
|
||||
*
|
||||
* Regression test for F-9763: hal_flash_write() in hal/stm32l5.c
|
||||
* Regression test: hal_flash_write() in hal/stm32l5.c
|
||||
* looped while (i < len) but each iteration unconditionally read both
|
||||
* 32-bit words of the 8-byte program unit (src[i>>2] and
|
||||
* src[(i>>2)+1]) and programmed both, regardless of how many bytes
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-stm32u5-write.c
|
||||
*
|
||||
* Regression test for F-9764: hal_flash_write() in hal/stm32u5.c
|
||||
* Regression test: hal_flash_write() in hal/stm32u5.c
|
||||
* looped while (i < len) but each iteration unconditionally read all
|
||||
* four 32-bit words of the 16-byte program unit (src[i>>2] through
|
||||
* src[(i>>2)+3]) and programmed the full quadword regardless of the
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-t10xx-dts-memac.c
|
||||
*
|
||||
* Regression test for F-7052: the fsl,fman-memac loop in
|
||||
* Regression test: the fsl,fman-memac loop in
|
||||
* hal_dts_fixup() (hal/nxp_t10xx.c) read the node's cell-index
|
||||
* straight from the device tree and used it to index the file-static
|
||||
* phydevs[5] with no bounds check - unlike the qman-portal loop right
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-t10xx-qe-firmware.c
|
||||
*
|
||||
* Regression test for F-8000: qe_check_firmware() in hal/nxp_t10xx.c
|
||||
* Regression test: qe_check_firmware() in hal/nxp_t10xx.c
|
||||
* validated the QE microcode header for self-consistency (magic,
|
||||
* version, count, length == computed size) but never bounded the
|
||||
* per-microcode code_offset against the declared image length.
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-t2080-fman-loader.c
|
||||
*
|
||||
* Regression test for F-9762: hal_fman_init() in hal/nxp_t2080.c
|
||||
* Regression test: hal_fman_init() in hal/nxp_t2080.c
|
||||
* checked only the NOR window guard and the QEF magic, then copied
|
||||
* fw->microcode[i].count words from fw + code_offset into FMan
|
||||
* instruction RAM and marked the engine ready. No version, count,
|
||||
|
|
@ -209,7 +209,7 @@ START_TEST(test_multi_risc_blob_accepted)
|
|||
END_TEST
|
||||
|
||||
/* count == 0 used to be accepted as a successful upload of nothing
|
||||
* (F-9762); it must now be rejected. */
|
||||
*; it must now be rejected. */
|
||||
START_TEST(test_zero_count_rejected)
|
||||
{
|
||||
make_blob(0, 0, 1, 0);
|
||||
|
|
@ -219,7 +219,7 @@ START_TEST(test_zero_count_rejected)
|
|||
END_TEST
|
||||
|
||||
/* A self-consistent blob whose microcode offset lies past the declared
|
||||
* image must be rejected (F-9762: the loader used to read from there
|
||||
* image must be rejected (the loader used to read from there
|
||||
* straight into FMan IRAM). */
|
||||
START_TEST(test_mcode_offset_past_image_rejected)
|
||||
{
|
||||
|
|
@ -230,7 +230,7 @@ START_TEST(test_mcode_offset_past_image_rejected)
|
|||
END_TEST
|
||||
|
||||
/* A self-consistent blob whose declared image extends past the end of
|
||||
* the NOR bank must be rejected (F-9762). */
|
||||
* the NOR bank must be rejected. */
|
||||
START_TEST(test_image_past_nor_extent_rejected)
|
||||
{
|
||||
struct qe_firmware *fw;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-ti-hercules-write.c
|
||||
*
|
||||
* Regression test for F-9736: the short-write path of hal_flash_write()
|
||||
* Regression test: the short-write path of hal_flash_write()
|
||||
* in hal/ti_hercules.c checked only len < WRITE_BLOCK_SIZE, not whether
|
||||
* (address % WRITE_BLOCK_SIZE) + len stayed inside the block. A short
|
||||
* write starting near the end of a block copied past the end of the
|
||||
|
|
@ -200,7 +200,7 @@ START_TEST(test_short_write_fits_block)
|
|||
}
|
||||
END_TEST
|
||||
|
||||
/* A short write crossing a block boundary (the F-9736 case): the first
|
||||
/* A short write crossing a block boundary (the case): the first
|
||||
* partial block and the remainder in the next block must both be
|
||||
* programmed, and nothing may be copied past the staging buffer. The
|
||||
* second program must also wait for the FSM: issued back-to-back it is
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-versal-ext-write.c
|
||||
*
|
||||
* Regression test for F-7981: ext_flash_write() in hal/versal.c
|
||||
* Regression test: ext_flash_write() in hal/versal.c
|
||||
* chunked the request into length-based FLASH_PAGE_SIZE transfers
|
||||
* (page 0, page 1, ...) without accounting for the start address's
|
||||
* offset inside the physical page. A write starting mid-page sent a
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-versal-qspi-dma.c
|
||||
*
|
||||
* Regression test for F-7982: the DMA RX path of qspi_transfer() in
|
||||
* Regression test: the DMA RX path of qspi_transfer() in
|
||||
* hal/versal.c. For an unaligned destination or a length not divisible
|
||||
* by four, the transfer runs through the 4096-byte dma_tmpbuf. If the
|
||||
* requested rxLen exceeded the temp buffer, dmaLen was truncated to
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-zynq-erase-loop.c
|
||||
*
|
||||
* Regression test for F-7980: ext_flash_erase() in hal/zynq.c initializes
|
||||
* Regression test: ext_flash_erase() in hal/zynq.c initializes
|
||||
* idx once before the multi-sector while (len > 0) loop and never resets
|
||||
* it, even though cmd is memset to zero each iteration. From the second
|
||||
* sector on, the erase command is written at cmd[idx] (past the start of
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
/* unit-zynq-ext-write.c
|
||||
*
|
||||
* Regression test for F-7979: ext_flash_write() in hal/zynq.c divided
|
||||
* Regression test: ext_flash_write() in hal/zynq.c divided
|
||||
* the request into length-based FLASH_PAGE_SIZE chunks (page 0, page
|
||||
* 1, ...) without accounting for the start address's offset inside
|
||||
* the device page. A write starting mid-page sent a full-page Page
|
||||
|
|
|
|||
Loading…
Reference in New Issue