ERASE_TIMEOUT was defined but never used; the final erase ACK used
the plain short WAIT_CYCLES budget, so a slow remote flash made
ext_flash_erase() fail even when the erase succeeded. Factor
wait_ack_cycles() out of wait_ack() and use WAIT_CYCLES *
ERASE_TIMEOUT for the erase ACK, like uart_rx_timeout() does with
READ_TIMEOUT. Add unit tests for the success and timeout paths.
The loop wrote the 5-byte 'pBOOT' trailer SWAP_SIZE times, emitting
5x SWAP_SIZE bytes past the 4KB swap region (the file grew 16KB past
the mmap'd device) and leaving the swap filled with 'pBOOT' instead
of the erased 0xFF state real flash has. Use the 0xFF pad loop the
non-WOLF path already uses.
The snprintf building output_diff_file passed
sizeof(CMD.output_image_file); both are char[PATH_MAX] today, so the
guarantee was accidental. Use sizeof of the destination.
argv[argc] is NULL, so a missing trailing argument (e.g. 'sign
--ecc256 img.bin key.der') yielded a NULL fw_version that crashed
strtoul, and --id/--encrypt/--delta/--policy as the last token
dereferenced NULL directly. Guard the four value-taking options like
--cert-chain already does, and validate the positional argument
count against the selected signing mode before indexing.
fread() returns size_t, so the (io_sz < 0) guard could never trigger,
and a short read silently folded stale buffer bytes into the image
digest. Compare the read count against the requested size in all
three loops (SHA-256, SHA-384, SHA3-384), matching the existing
io_sz != expected pattern used elsewhere in this file.
case 4 masked to 32 bits then fell through into case 8, whose only
statement is break. Harmless today, but indistinguishable from a
genuine missing break; add the explicit break.
- Add missing END_TEST after each START_TEST in unit-nrf5340-uart-crlf.c
- Fix partition overlap checks in target.h.in to use standard interval
intersection (catches partitions that start below WOLFBOOT_ORIGIN and
extend into the bootloader region)
nrf5340: the target references nrf5340_uart_crlf (src/update_flash.c)
but the Makefile does not compile hal/nrf5340_uart.c, so the linker
fails. Add the object to OBJS (Makefile) and APP_OBJS (test-app).
cypsoc6: the new boot/update/swap vs bootloader-region #error guards
in include/target.h.in fire on the cypsoc6 layout, where the boot
partition intentionally overlaps the bootloader region (the bootloader
and the boot image share the same flash region). Introduce
WOLFBOOT_ALLOW_PART_OVERLAP (defined in cypsoc6.config, gated in
target.h.in, added to CONFIG_VARS in tools/config.mk) to suppress the
guards for targets that legitimately overlap.
Verified: nrf5340 builds (make distclean + cp config + make, exit 0,
wolfboot.bin created). cypsoc6 cannot be built locally (the CI checks
out lib/psoc6pdl from Infineon, which is not available locally), but
the WOLFBOOT_ALLOW_PART_OVERLAP guard is verified to suppress the
#error for the cypsoc6 layout.
A completed swap must leave the update partition as a faithful copy of
the previous boot image, so the emergency-rollback path (the
IMG_STATE_TESTING branch calling wolfBoot_update(1) to swap back) can
restore the original byte-for-byte. The backup half of the swap (the
boot->update copy, which under EXT_ENCRYPTED runs under
wolfBoot_enable_fallback_iv(1)) was otherwise never read back: the
forward direction is implicitly checked by wolfBoot_verify_integrity, but
the reverse direction had no backstop. Add
test_update_then_rollback_{samesize,larger,smaller}: install version 2,
snapshot the original boot image, re-run wolfBoot_start (the fallback
branch), and assert version 1 + memcmp(boot, snapshot) == 0. Parameterised
over same/larger/smaller payloads to cover the tail-sector copy guard in
both directions. Mutation-verified: skipping the boot->update copy breaks
the tests. Runs in the enc-full target, which exercises the encrypted
backup path.
The signer (sign.c) accepts total_img_sz == max_img_sz (the exact fit:
header + payload + trailer == partition size), but wolfBoot_update
rejected fw_size == MAX_UPDATE_SIZE via '> MAX_UPDATE_SIZE - 1', leaving
a 1-byte gap and an off-by-one between the two components. Drop the '- 1'
so the updater accepts the exact fit the signer produces. Rename
test_update_max_size_rejected to _accepted (version 2 now stages) and add
test_update_max_size_plus_one_rejected (MAX_UPDATE_SIZE + 1 still rejected).
The resume test stages a plain image, which the encrypted swap path
(unit-update-flash-enc-full) does not accept, so the test failed there.
The resume logic is identical with or without encryption, so the
non-encrypted target covers it; guard the test and its registration
behind !EXT_ENCRYPTED.
The region guard (offset > ctx->size || size > ctx->size - offset) in
whFlashH5_Erase/Verify/BlankCheck was untested for out-of-bounds input.
Erase's alignment checks run after the bounds check, so an aligned OOB
erase would pass alignment and erase adjacent flash with the guard removed;
Verify/BlankCheck would walk OOB. Add aligned OOB cases (offset = ctx.size,
size = sector; and offset 0, size = ctx.size + sector) asserting
WH_ERROR_BADARGS. Mutation-verified: removing the Erase guard makes the OOB
erase return ABORTED (the mock rejects the OOB erase) instead of BADARGS.
A power fail mid-swap leaves the sector loop at the SECT_FLAG_BACKUP
fall-through entry point, which no prior test reached (the fault-injection
tests only aborted on the first write, and the vault resume tests cover a
different path). Fault the first internal write (the swap->BOOT copy of
sector 0) via the existing single-shot hal_flash_write_fail, re-run
wolfBoot_update, and verify it re-enters the loop at case SECT_FLAG_BACKUP
and ends with the partitions swapped. Only the BACKUP state is a recoverable
power fail: faulting the BOOT->update copy instead (SWAPPING state) erases
the update header, so the resume's re-open fails - that entry point is not
testable as a roundtrip. Mutation-verified (skipping the swap->boot copy
breaks the test).
The keystore keygen emits (default for non-OTP, non-wolfHSM builds)
lacked the id < 0 guard the OTP backend has: get_buffer/get_size/get_mask
tested only id >= num (a negative id indexed PubKeys[] out of bounds) and
get_key_type had no bounds check. Add 'id < 0 ||' to all four. Add
unit-keygen-keystore, which sed-extracts the real Keystore_API template
from keygen.c, emits a self-contained keystore.c (keystore_gen.c), compiles
it, and asserts the same out-of-range contract unit-otp-keystore pins.
Mutation (drop the get_buffer guard) makes keystore_get_buffer(-1) return
non-NULL, caught.
The region count truncated (n = len / SPU_FLASH_BLOCK_SIZE), so a len
smaller than one 16 KiB SPU block locked nothing and a non-multiple len
left the tail block writable, while the function returned 0 either way.
Round the block count up so the locked range covers [start, start+len)
whole (partial blocks at both ends locked whole, which only ever widens
protection), and reject len < 0. Add unit-nrf5340-flash-protect, which
sed-extracts the real function and runs it against a mock SPU region
array; mutation (revert to the truncating count) fails 3 of 6 tests.
Add unit-nsc-update, the first unit target defining TZEN. It compiles
libwolfboot.c with __WOLFBOOT + TZEN (non-CMSE: WOLFBOOT_NSC_NS_RW is a
pass-through) against the mock flash and checks the accept/reject sides
of the wolfBoot_nsc_erase_update / wolfBoot_nsc_write_update range checks,
which had no unit coverage. A weakened len bound is caught by the straddle
case writing past the partition end.
The size model was only compared against make_header_ex for NO_SIGN,
no-timestamp, non-delta. Drive the cross product of sign/policy/
timestamp/delta/dts/hash-algo and assert the writer's final content
size stays <= the model, via a test hook that records header_idx
before the 0xFF padding. Hybrid is excluded (its secondary signature
needs a real key context). Mutation-verified: removing the model's
timestamp term makes the test fail (idx > required).
Also reject a custom TLV reusing the --dts digest tag (F-9754): it
would serialize ahead of the real digest and shadow it.
The --cmdline option stores the OS command line as a signature-covered
TLV (tag HDR_CMDLINE) that the bootloader recovers via
wolfBoot_find_header(); the roundtrip had zero coverage. Add
test_make_header_ex_roundtrip_cmdline_tlv: for lengths 1, 2, 3, 69, 70,
71, 255 (odd/even + extremes + the ~70-byte default-capacity boundary)
sign via make_header_ex and assert the decoder returns exactly the
signed bytes; 255 also pins the 256->512 header auto-grow.
The hdr_size < GPT_HDR_MIN_SIZE || > GPT_SECTOR_SIZE guard was untested;
a crafted 0xFFFFFFFF hdr_size would drive the CRC read ~4GB past the
512-byte stack header. New test rejects both bounds; the lower case
recomputes the CRC over the reduced size so a deleted lower clause would
accept the header (return 0), pinning the clause.
encrypt_key_is_valid() rejects an erased key (all 0x00 or all 0xFF) but
had no test, so deleting the check or flipping its && to || survived.
Add three cases (all-0x00, all-0xFF, valid); both erased cases fail
under ||, which pins the &&.
The one negative test corrupted byte 0, tripping the magic and CRC gates
at once, so a deleted gate was still caught by its siblings. Add three
tests (magic/version/crc), each recomputing the header CRC so only the
corrupted field's gate can reject.
After emitting CRLF the buffer advanced to the newline, not the byte
after it, so multiline input reprocessed the newline (stray CRLFs) and
lost the following text. Extract the CRLF conversion to
hal/nrf5340_uart.c (no nrfx) for host unit testing; add a regression
test.
The wolfSSL bump to master 4aa1ad7a5 wraps all of coding.h in
"#ifndef NO_CODING". That block also holds the auto-enable that turns
WOLFSSL_KEY_GEN into WOLFSSL_BASE64_ENCODE, so wolfBoot configurations
that set both WOLFSSL_KEY_GEN (SECURE_PKCS11) and NO_CODING lost the
Base64_Encode() declaration -- and coding.c compiles to nothing under
NO_CODING, so the definition is gone too. settings.h still derives
WOLFSSL_DER_TO_PEM from WOLFSSL_KEY_GEN, so asn.c kept compiling
wc_DerToPemEx() and failed with an implicit declaration of
Base64_Encode(). This broke every TrustZone and PKCS11 target.
wolfBoot never emits PEM, so define WOLFSSL_NO_DER_TO_PEM whenever
NO_CODING is set rather than pulling base64 back in. The check sits
after the HAVE_FIPS block, which may undef NO_CODING. wolfTPM's
wc_DerToPem() callers are themselves guarded by WOLFSSL_DER_TO_PEM, so
they simply drop their optional PEM encoding path.
Separately, the update grows wolfboot by 8-136 bytes depending on the
configuration, so re-measure every test-size-all entry with the CI
container and record the new sizes.
After writing both partitions, re-read BOOT and confirm it still
holds TESTING, so a backend that routes both IDs to the same
trailer is caught (previously each read followed its own write).
Verification: make -C tools/unit-tests unit-custom-trailer-nopart
exits 0; suite runs 1 check, 0 failures.
Replace EXIT_SUCCESS/EXIT_FAILURE with 0/1; the test does not
include <stdlib.h> and does not need the named macros.
Verification: make -C tools/unit-tests unit-custom-trailer-nopart
exits 0; suite runs 1 check, 0 failures.
test_fixed_partition_apis_absent only asserted the build config
(0==0 when WOLFBOOT_FIXED_PARTITIONS is off), which the successful
compile of the same target already proves. Reviewer nit.
Verification: make -C tools/unit-tests unit-custom-trailer-nopart
exits 0; suite runs 1 check, 0 failures.
- libwolfboot.c: keep the partition state APIs (set/get_partition_state)
available to CUSTOM_PARTITION_TRAILER / WOLFBOOT_NO_PARTITIONS builds;
guard the fixed-partition APIs (sector flags, erase, trigger, success)
behind WOLFBOOT_FIXED_PARTITIONS. Add the unit-custom-trailer-nopart
compile target to lock in that configuration.
- unit-p1021-fcm-bytes.c: add program tests for status 0x81 (fail) and
0x00 (write-protected), asserting no later page is programmed.
- unit-p1021-erase-advance.c: add an erase test for status 0x00
(write-protected), asserting failure before advancing to the next block.
- hal/nxp_p1021.c: fix ONFI status polarity (bit 0 set = fail, bit 7
clear = protected; was checking bits 0+1 set = success)
- src/libwolfboot.c: move partition state APIs under HAVE_PARTITION_TRAILERS
so CUSTOM_PARTITION_TRAILER without WOLFBOOT_FIXED_PARTITIONS links
- src/x86/ata.c: do not zeroize DMA buffer when another async op is
in progress (buffer still owned by first command's transfer)
- unit-p1021-fcm-bytes/erase-advance: update mocks to ONFI status bytes
- unit-update-ram-custom-trailer: add BOOT selection assertion via
mock_max_read_addr, PID-suffixed temp files, unlink in cleanup
- unit-update-ram-nofixed-noramboot: unlink PID-specific temp files
- src/x86/ata.c: verify PxCI is clear in the TFES path before scrubbing
the DMA buffer (symmetric with the success path; prevents scrubbing
while the HBA may still reference the buffer)
- unit-update-ram-nofixed-noramboot.c: append PID to /tmp filenames to
avoid collisions under parallel make -j or shared runners
Add HAVE_PARTITION_TRAILERS macro (set when WOLFBOOT_FIXED_PARTITIONS or
CUSTOM_PARTITION_TRAILER is defined) and use it to gate the TESTING state
transition in update_ram.c. Previously the gate was WOLFBOOT_FIXED_PARTITIONS
only, so targets using custom partition trailers never transitioned from
UPDATING to TESTING, allowing rollback to older versions.
Add unit-update-ram-custom-trailer test covering the CUSTOM_PARTITION_TRAILER
path with mocked get/set_trailer_at callbacks.
GCC 14+ defaults to gnu23, where glibc string.h defines memchr
and memcpy as _Generic macros that clash with wolfBoot's own
declarations in tests that #include a .c file (unit-string).
gnu17 matches the CI toolchain default.
keygen_die() (F-9767) calls wc_FreeRng(); the test mocks
keygen.c's wolfCrypt dependencies one by one and was missing
this one, breaking the unit_tests and test_external_libs jobs.
security_command_passphrase() only wiped the static DMA buffer on the
synchronous path; in async mode (ata_security_erase_unit) the
passphrase stayed resident in the file-static buffer for the rest of
the boot, since ata_cmd_complete_async() never scrubbed it.
Add a scrub_buffer flag to the async state, set it when the command
goes in flight (or wipe immediately if it never started), and scrub in
ata_cmd_complete_async() on both the success and task-file-error exits,
once the HBA has retired the command.
Covered by two new unit tests: scrub after async completion and after
an async port error; the in-flight state is asserted unscrubbed.
Reported by Fenrir.
The TPM NV auth copy and the HMAC session state lived on the
stack until process teardown. Zeroize both at the common exit
label after the TPM device is unloaded, on success and error
paths alike.
keygen_ed25519/ed448/lms/xmss/ml_dsa have the same bypass as
the RSA/ECC helpers: exit() from their cleanup labels skips
main()'s wc_FreeRng(). Route their failure exits through
keygen_die() as well.
keygen_rsa/keygen_ecc exit() from their own cleanup labels,
bypassing main()'s wc_FreeRng() and leaving DRBG state resident.
Add keygen_die() that frees and zeroes the RNG before exit and
use it in the two helpers' failure paths.
The error path returned before the common wc_FreeRng(), leaving
DRBG state on the stack. Route it through the shared cleanup and
guard the sign call so hash_type/mgf are only used when set.
The F-12922 test checks fallback to the lower version, but the
TCase was still named "rollback denied" from before the fix,
describing the opposite behavior.
ext_flash_erase() now checks NAND_STATUS_FAIL | NAND_STATUS_WPS
(F-12881), but the sed extraction rule only pulled the command
defines, so the unit_tests CI jobs failed to compile the test.
pkcs11_crypto_init() tore down the session on failure but left the
pre-populated pkcs11_pin credential in retained bootloader memory
after the handoff. Wipe it in the failure path, same as the deinit
path (F-12114). Regression test in unit-pkcs11-pin-zeroize: login
rejected -> init fails -> every pin byte is zero.
The version gate in the retry loop panicked whenever the selected
candidate failed verification and the fallback partition carried a
lower version, even though that image is valid and signed. A single
corrupted higher-version image bricked the device instead of falling
back. The gate only ever fired on the failure path (candidate
selection already prefers the higher version), so remove it; the
TESTING-state anti-rollback check in wolfBoot_dualboot_candidate()
still guards the confirmed-update path.
Daniele Lacamera
Aidan Garske
David Garske