ERASE_TIMEOUT was defined but never used; the final erase ACK used
the plain short WAIT_CYCLES budget, so a slow remote flash made
ext_flash_erase() fail even when the erase succeeded. Factor
wait_ack_cycles() out of wait_ack() and use WAIT_CYCLES *
ERASE_TIMEOUT for the erase ACK, like uart_rx_timeout() does with
READ_TIMEOUT. Add unit tests for the success and timeout paths.
The loop wrote the 5-byte 'pBOOT' trailer SWAP_SIZE times, emitting
5x SWAP_SIZE bytes past the 4KB swap region (the file grew 16KB past
the mmap'd device) and leaving the swap filled with 'pBOOT' instead
of the erased 0xFF state real flash has. Use the 0xFF pad loop the
non-WOLF path already uses.
The snprintf building output_diff_file passed
sizeof(CMD.output_image_file); both are char[PATH_MAX] today, so the
guarantee was accidental. Use sizeof of the destination.
argv[argc] is NULL, so a missing trailing argument (e.g. 'sign
--ecc256 img.bin key.der') yielded a NULL fw_version that crashed
strtoul, and --id/--encrypt/--delta/--policy as the last token
dereferenced NULL directly. Guard the four value-taking options like
--cert-chain already does, and validate the positional argument
count against the selected signing mode before indexing.
fread() returns size_t, so the (io_sz < 0) guard could never trigger,
and a short read silently folded stale buffer bytes into the image
digest. Compare the read count against the requested size in all
three loops (SHA-256, SHA-384, SHA3-384), matching the existing
io_sz != expected pattern used elsewhere in this file.
case 4 masked to 32 bits then fell through into case 8, whose only
statement is break. Harmless today, but indistinguishable from a
genuine missing break; add the explicit break.
Three CI failures from the new bootloader-region overlap guards:
renesas_rx72n: the swap check measured the swap area as a full
WOLFBOOT_PARTITION_SIZE, but swap is one sector (the pre-existing
boot/update-vs-swap guards already use WOLFBOOT_SECTOR_SIZE). On rx72n
that inflated swap to 0xFFFE0000+0x1F0000 and falsely overlapped the
write-protect region at 0xFFFF0000. Use WOLFBOOT_SECTOR_SIZE.
- Add missing END_TEST after each START_TEST in unit-nrf5340-uart-crlf.c
- Fix partition overlap checks in target.h.in to use standard interval
intersection (catches partitions that start below WOLFBOOT_ORIGIN and
extend into the bootloader region)
The test-app Makefile was not linking nrf5340_uart.o (which defines
nrf5340_uart_crlf) for nrf5340% targets with DEBUG_UART=1, causing
'undefined reference to nrf5340_uart_crlf' when linking image.elf.
Also guard the main Makefile's nrf5340_uart.o with DEBUG_UART=1 for
consistency.
nrf5340: the target references nrf5340_uart_crlf (src/update_flash.c)
but the Makefile does not compile hal/nrf5340_uart.c, so the linker
fails. Add the object to OBJS (Makefile) and APP_OBJS (test-app).
cypsoc6: the new boot/update/swap vs bootloader-region #error guards
in include/target.h.in fire on the cypsoc6 layout, where the boot
partition intentionally overlaps the bootloader region (the bootloader
and the boot image share the same flash region). Introduce
WOLFBOOT_ALLOW_PART_OVERLAP (defined in cypsoc6.config, gated in
target.h.in, added to CONFIG_VARS in tools/config.mk) to suppress the
guards for targets that legitimately overlap.
Verified: nrf5340 builds (make distclean + cp config + make, exit 0,
wolfboot.bin created). cypsoc6 cannot be built locally (the CI checks
out lib/psoc6pdl from Infineon, which is not available locally), but
the WOLFBOOT_ALLOW_PART_OVERLAP guard is verified to suppress the
#error for the cypsoc6 layout.
The boot, update and swap partitions were never checked against the
bootloader write-protect region [WOLFBOOT_ORIGIN, WOLFBOOT_ORIGIN +
BOOTLOADER_PARTITION_SIZE). An over-sized BOOTLOADER_PARTITION_SIZE
silently write-protects the head of a partition; the existing
boot/update/swap overlap guards did not cover this.
Add three #error guards (boot, update, swap vs bootloader region) to
include/target.h.in, gated on WOLFBOOT_ORIGIN < the partition address so
they only fire for real targets (the mock target has WOLFBOOT_ORIGIN ==
WOLFBOOT_PARTITION_BOOT_ADDRESS, a valid simplified geometry).
The undersized guard (BOOTLOADER_PARTITION_SIZE not covering the
self-update erase range) is deferred: it requires a compile-time
constant for ARCH_FLASH_OFFSET, which is a runtime value (sim_ram_base)
for the mock target.
The compile-only negative tests (part 2 of the finding) are deferred.
A completed swap must leave the update partition as a faithful copy of
the previous boot image, so the emergency-rollback path (the
IMG_STATE_TESTING branch calling wolfBoot_update(1) to swap back) can
restore the original byte-for-byte. The backup half of the swap (the
boot->update copy, which under EXT_ENCRYPTED runs under
wolfBoot_enable_fallback_iv(1)) was otherwise never read back: the
forward direction is implicitly checked by wolfBoot_verify_integrity, but
the reverse direction had no backstop. Add
test_update_then_rollback_{samesize,larger,smaller}: install version 2,
snapshot the original boot image, re-run wolfBoot_start (the fallback
branch), and assert version 1 + memcmp(boot, snapshot) == 0. Parameterised
over same/larger/smaller payloads to cover the tail-sector copy guard in
both directions. Mutation-verified: skipping the boot->update copy breaks
the tests. Runs in the enc-full target, which exercises the encrypted
backup path.
The signer (sign.c) accepts total_img_sz == max_img_sz (the exact fit:
header + payload + trailer == partition size), but wolfBoot_update
rejected fw_size == MAX_UPDATE_SIZE via '> MAX_UPDATE_SIZE - 1', leaving
a 1-byte gap and an off-by-one between the two components. Drop the '- 1'
so the updater accepts the exact fit the signer produces. Rename
test_update_max_size_rejected to _accepted (version 2 now stages) and add
test_update_max_size_plus_one_rejected (MAX_UPDATE_SIZE + 1 still rejected).
The resume test stages a plain image, which the encrypted swap path
(unit-update-flash-enc-full) does not accept, so the test failed there.
The resume logic is identical with or without encryption, so the
non-encrypted target covers it; guard the test and its registration
behind !EXT_ENCRYPTED.
The region guard (offset > ctx->size || size > ctx->size - offset) in
whFlashH5_Erase/Verify/BlankCheck was untested for out-of-bounds input.
Erase's alignment checks run after the bounds check, so an aligned OOB
erase would pass alignment and erase adjacent flash with the guard removed;
Verify/BlankCheck would walk OOB. Add aligned OOB cases (offset = ctx.size,
size = sector; and offset 0, size = ctx.size + sector) asserting
WH_ERROR_BADARGS. Mutation-verified: removing the Erase guard makes the OOB
erase return ABORTED (the mock rejects the OOB erase) instead of BADARGS.
A power fail mid-swap leaves the sector loop at the SECT_FLAG_BACKUP
fall-through entry point, which no prior test reached (the fault-injection
tests only aborted on the first write, and the vault resume tests cover a
different path). Fault the first internal write (the swap->BOOT copy of
sector 0) via the existing single-shot hal_flash_write_fail, re-run
wolfBoot_update, and verify it re-enters the loop at case SECT_FLAG_BACKUP
and ends with the partitions swapped. Only the BACKUP state is a recoverable
power fail: faulting the BOOT->update copy instead (SWAPPING state) erases
the update header, so the resume's re-open fails - that entry point is not
testable as a roundtrip. Mutation-verified (skipping the swap->boot copy
breaks the test).
The keystore keygen emits (default for non-OTP, non-wolfHSM builds)
lacked the id < 0 guard the OTP backend has: get_buffer/get_size/get_mask
tested only id >= num (a negative id indexed PubKeys[] out of bounds) and
get_key_type had no bounds check. Add 'id < 0 ||' to all four. Add
unit-keygen-keystore, which sed-extracts the real Keystore_API template
from keygen.c, emits a self-contained keystore.c (keystore_gen.c), compiles
it, and asserts the same out-of-range contract unit-otp-keystore pins.
Mutation (drop the get_buffer guard) makes keystore_get_buffer(-1) return
non-NULL, caught.
The region count truncated (n = len / SPU_FLASH_BLOCK_SIZE), so a len
smaller than one 16 KiB SPU block locked nothing and a non-multiple len
left the tail block writable, while the function returned 0 either way.
Round the block count up so the locked range covers [start, start+len)
whole (partial blocks at both ends locked whole, which only ever widens
protection), and reject len < 0. Add unit-nrf5340-flash-protect, which
sed-extracts the real function and runs it against a mock SPU region
array; mutation (revert to the truncating count) fails 3 of 6 tests.
Add unit-nsc-update, the first unit target defining TZEN. It compiles
libwolfboot.c with __WOLFBOOT + TZEN (non-CMSE: WOLFBOOT_NSC_NS_RW is a
pass-through) against the mock flash and checks the accept/reject sides
of the wolfBoot_nsc_erase_update / wolfBoot_nsc_write_update range checks,
which had no unit coverage. A weakened len bound is caught by the straddle
case writing past the partition end.
The size model was only compared against make_header_ex for NO_SIGN,
no-timestamp, non-delta. Drive the cross product of sign/policy/
timestamp/delta/dts/hash-algo and assert the writer's final content
size stays <= the model, via a test hook that records header_idx
before the 0xFF padding. Hybrid is excluded (its secondary signature
needs a real key context). Mutation-verified: removing the model's
timestamp term makes the test fail (idx > required).
Also reject a custom TLV reusing the --dts digest tag (F-9754): it
would serialize ahead of the real digest and shadow it.
The --cmdline option stores the OS command line as a signature-covered
TLV (tag HDR_CMDLINE) that the bootloader recovers via
wolfBoot_find_header(); the roundtrip had zero coverage. Add
test_make_header_ex_roundtrip_cmdline_tlv: for lengths 1, 2, 3, 69, 70,
71, 255 (odd/even + extremes + the ~70-byte default-capacity boundary)
sign via make_header_ex and assert the decoder returns exactly the
signed bytes; 255 also pins the 256->512 header auto-grow.
The hdr_size < GPT_HDR_MIN_SIZE || > GPT_SECTOR_SIZE guard was untested;
a crafted 0xFFFFFFFF hdr_size would drive the CRC read ~4GB past the
512-byte stack header. New test rejects both bounds; the lower case
recomputes the CRC over the reduced size so a deleted lower clause would
accept the header (return 0), pinning the clause.
encrypt_key_is_valid() rejects an erased key (all 0x00 or all 0xFF) but
had no test, so deleting the check or flipping its && to || survived.
Add three cases (all-0x00, all-0xFF, valid); both erased cases fail
under ||, which pins the &&.
The one negative test corrupted byte 0, tripping the magic and CRC gates
at once, so a deleted gate was still caught by its siblings. Add three
tests (magic/version/crc), each recomputing the header CRC so only the
corrupted field's gate can reject.
After emitting CRLF the buffer advanced to the newline, not the byte
after it, so multiline input reprocessed the newline (stray CRLFs) and
lost the following text. Extract the CRLF conversion to
hal/nrf5340_uart.c (no nrfx) for host unit testing; add a regression
test.
The wolfSSL bump to master 4aa1ad7a5 wraps all of coding.h in
"#ifndef NO_CODING". That block also holds the auto-enable that turns
WOLFSSL_KEY_GEN into WOLFSSL_BASE64_ENCODE, so wolfBoot configurations
that set both WOLFSSL_KEY_GEN (SECURE_PKCS11) and NO_CODING lost the
Base64_Encode() declaration -- and coding.c compiles to nothing under
NO_CODING, so the definition is gone too. settings.h still derives
WOLFSSL_DER_TO_PEM from WOLFSSL_KEY_GEN, so asn.c kept compiling
wc_DerToPemEx() and failed with an implicit declaration of
Base64_Encode(). This broke every TrustZone and PKCS11 target.
wolfBoot never emits PEM, so define WOLFSSL_NO_DER_TO_PEM whenever
NO_CODING is set rather than pulling base64 back in. The check sits
after the HAVE_FIPS block, which may undef NO_CODING. wolfTPM's
wc_DerToPem() callers are themselves guarded by WOLFSSL_DER_TO_PEM, so
they simply drop their optional PEM encoding path.
Separately, the update grows wolfboot by 8-136 bytes depending on the
configuration, so re-measure every test-size-all entry with the CI
container and record the new sizes.
After writing both partitions, re-read BOOT and confirm it still
holds TESTING, so a backend that routes both IDs to the same
trailer is caught (previously each read followed its own write).
Verification: make -C tools/unit-tests unit-custom-trailer-nopart
exits 0; suite runs 1 check, 0 failures.
Replace EXIT_SUCCESS/EXIT_FAILURE with 0/1; the test does not
include <stdlib.h> and does not need the named macros.
Verification: make -C tools/unit-tests unit-custom-trailer-nopart
exits 0; suite runs 1 check, 0 failures.
test_fixed_partition_apis_absent only asserted the build config
(0==0 when WOLFBOOT_FIXED_PARTITIONS is off), which the successful
compile of the same target already proves. Reviewer nit.
Verification: make -C tools/unit-tests unit-custom-trailer-nopart
exits 0; suite runs 1 check, 0 failures.
Check ata_async_info.in_progress before preparing the slot or touching
the shared buffer, so a second security command cannot clobber the
passphrase still being DMA'd. With that guard an async call always
means in flight (exec_cmd_slot_ex sets in_progress and returns BUSY),
so the post-command scrub is unconditional for the async path.
Daniele Lacamera
Aidan Garske
David Garske
Alex Lanzano