mirror of https://github.com/wolfSSL/wolfBoot.git
F-11025: update_flash: document deliberately inert PCR extend block
The PCR-extension block in wolfBoot_unlock_disk() is guarded with !defined(ARCH_SIM) while the function itself only builds for ARCH_SIM, so it can never compile. The exclusion is deliberate (eb2978ab: do not extend the unseal PCR on the simulator, or the secret becomes un-unsealable), not an oversight. Clarify the comment with the intended build scope instead of removing the block: the code and the WOLFBOOT_NO_UNSEAL_PCR_EXTEND option exist for the day the unlock-disk path is ported to a non-sim target.pull/882/head
parent
eb3d587fe2
commit
785a285ca7
|
|
@ -1499,7 +1499,11 @@ int wolfBoot_unlock_disk(void)
|
|||
/* TODO: Unlock disk */
|
||||
|
||||
|
||||
/* Extend a PCR from the mask to prevent future unsealing */
|
||||
/* Extend a PCR from the mask to prevent future unsealing.
|
||||
* Non-sim only: extending on the simulator would lock the
|
||||
* PCR and block future unseals (eb2978ab). The function is
|
||||
* ARCH_SIM-only today, so the block is inert until the
|
||||
* unlock path is ported. */
|
||||
#if !defined(ARCH_SIM) && !defined(WOLFBOOT_NO_UNSEAL_PCR_EXTEND)
|
||||
{
|
||||
uint32_t pcrMask;
|
||||
|
|
|
|||
Loading…
Reference in New Issue