The store commits sectors with hal_flash_erase()/hal_flash_write() and
then reads them back through the memory map - sector_ptr(),
cache_get_sector()'s refill, and the raw magic reads in check_vault().
On a part that caches flash reads (STM32 ICACHE) those reads can return
pre-erase bytes. check_vault() is the worst case: a stale magic there
does not merely read wrong, it triggers restore_backup() or a full vault
re-initialisation, losing the token.
An unaligned starting address split the four word stores across two
16-byte program units, leaving partial quad-words that set
FLASH_SR_WDW and hang the wait for completion. Align the destination
down to the unit, read-modify-write the whole unit, and store through
the aligned pointer. The unit test gains unaligned-start cases.
Drop the internal report numbers from source, test and Makefile
comments: they mean nothing outside the tracker and do not belong in
the tree. Condense the long inline comment blocks the review flagged,
and note in the raspi3 encrypted example and its docs that CI builds
but does not boot it, so the end-to-end path has no automated
coverage.
Comments and docs only; no functional change.
The partial-tail handling skipped the words that hold no requested
byte. Neither part can do that: U5 only starts the 128-bit program on
the fourth word (a partial quad-word leaves FLASH_SR_WDW set and
hal_flash_wait_complete() never returns), and L5 has no 32-bit program
mode, so splitting the double word into two PG cycles programs
nothing and faults the second on alignment.
Build the full unit first, taking bytes outside [i, len) from the
current flash content as hal/stm32h5.c does, then store every word.
That drops the over-read F-9763/F-9764 targeted without ever issuing
a partial unit. L5 TZ claim widened to the 8-byte boundary to match.
hal_flash_write() looped while (i < len) but programmed whole 16-byte
units: each iteration read all four 32-bit source words unconditionally
and wrote the full quadword to flash, so a write whose length is not a
multiple of 16 read up to 12 bytes past the caller's buffer - which
the NSC update path validates for exactly len - and wrote those bytes
to flash.
Program the unit word by word: each word is written only when at least
one of its bytes is requested, and a partial final word is padded with
the erased value (0xFF) in its upper bytes so no source bytes past len
are read. The single PG/wait/clear sequence per unit is unchanged.
Test: tools/unit-tests/unit-stm32u5-write.c is the 16-byte twin of the
STM32L5 test (F-9763): it extracts the real hal_flash_write() and its
wait/clear helpers, maps the destination flash at a 32-bit host address
(the parameter is uint32_t on this 32-bit target) pre-filled with stale
data, and runs short writes; pre-fix the bytes past len landed in the
destination flash in all four partial-unit cases.
On STM32U5 the BKER bit in FLASH_NSCR/SECCR always selects the
physical bank: the SWAP_BANK option only changes the address mapping
of the banks (RM0456 7.5.8, and confirmed on silicon). hal_flash_erase
derived BKER from the logical address only, so with SWAP_BANK active
every page erase landed in the bank opposite to the one mapped at the
target address.
In DUALBANK_SWAP mode this broke fallback recovery: when image
verification failed while running from bank 2, wolfBoot_erase_partition
(PART_UPDATE) erased the healthy image in the active bank instead of
the failing update, leaving the device unable to boot. The same
mismatch corrupted any erase issued while swapped, including staging a
new update from the application.
Invert BKER when both DBANK and SWAP_BANK are set, mirroring the
STM32H5 HAL which already handles this (RM0481 has the same physical
bank semantics). STM32L5 is not affected: RM0438 defines NSBKER as the
page number MSB, which follows the mapped address.
Verified on the m33mu emulator with hardware-faithful BKER/SWAP_BANK
modeling: full cycle (update to bank 2, swap, stage corrupt update,
verify failure) now erases the corrupt update and falls back to the
healthy image; before this fix the healthy image was erased and the
device bricked.
- New config flags for flash geometry
- New script to automatically set option bytes
- End of stack address fix for the STM32U5 test app
- STM32U5 support for NUCLEO-U575ZI-Q (previously only supported
discovery board)
fork_bootloader() should perform a physical copy of
the bootloader to its partition in the second bank only
if the content of the two partitions does not already match.
Daniele Lacamera
Mattia Moffa
David Garske
gojimmypi
Daniele Lacamera
Dimitri Papadopoulos