F-11025: update_flash: document deliberately inert PCR extend block

The PCR-extension block in wolfBoot_unlock_disk() is guarded with
!defined(ARCH_SIM) while the function itself only builds for
ARCH_SIM, so it can never compile. The exclusion is deliberate
(eb2978ab: do not extend the unseal PCR on the simulator, or the
secret becomes un-unsealable), not an oversight.

Clarify the comment with the intended build scope instead of
removing the block: the code and the WOLFBOOT_NO_UNSEAL_PCR_EXTEND
option exist for the day the unlock-disk path is ported to a
non-sim target.
pull/882/head
Daniele Lacamera 2026-09-04 11:13:32 +02:00
parent eb3d587fe2
commit 785a285ca7
1 changed files with 5 additions and 1 deletions

View File

@ -1499,7 +1499,11 @@ int wolfBoot_unlock_disk(void)
/* TODO: Unlock disk */
/* Extend a PCR from the mask to prevent future unsealing */
/* Extend a PCR from the mask to prevent future unsealing.
* Non-sim only: extending on the simulator would lock the
* PCR and block future unseals (eb2978ab). The function is
* ARCH_SIM-only today, so the block is inert until the
* unlock path is ported. */
#if !defined(ARCH_SIM) && !defined(WOLFBOOT_NO_UNSEAL_PCR_EXTEND)
{
uint32_t pcrMask;