From 785a285ca751b220ebfdfce17d5ce76e065808f9 Mon Sep 17 00:00:00 2001 From: Daniele Lacamera Date: Fri, 4 Sep 2026 11:13:32 +0200 Subject: [PATCH] F-11025: update_flash: document deliberately inert PCR extend block The PCR-extension block in wolfBoot_unlock_disk() is guarded with !defined(ARCH_SIM) while the function itself only builds for ARCH_SIM, so it can never compile. The exclusion is deliberate (eb2978ab: do not extend the unseal PCR on the simulator, or the secret becomes un-unsealable), not an oversight. Clarify the comment with the intended build scope instead of removing the block: the code and the WOLFBOOT_NO_UNSEAL_PCR_EXTEND option exist for the day the unlock-disk path is ported to a non-sim target. --- src/update_flash.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/update_flash.c b/src/update_flash.c index 5f398d71..c129eff5 100644 --- a/src/update_flash.c +++ b/src/update_flash.c @@ -1499,7 +1499,11 @@ int wolfBoot_unlock_disk(void) /* TODO: Unlock disk */ - /* Extend a PCR from the mask to prevent future unsealing */ + /* Extend a PCR from the mask to prevent future unsealing. + * Non-sim only: extending on the simulator would lock the + * PCR and block future unseals (eb2978ab). The function is + * ARCH_SIM-only today, so the block is inert until the + * unlock path is ported. */ #if !defined(ARCH_SIM) && !defined(WOLFBOOT_NO_UNSEAL_PCR_EXTEND) { uint32_t pcrMask;