hal_flash_erase() rounded an unaligned address down to the sector boundary
but left len at the caller's value, so a request ending in a later sector
erased only the first one. Grow len by the same amount.
test_erase_zero_runtime_sector_falls_back covered a request that ends
0x10 into the second sector, so its one-erase expectation encoded the
under-erase; it now expects both.
F-6757 fixed the byte-wise path but left the fast path above it indexing
dst[i >> 2]/src[i >> 2] off the call-time base. The guard only proves that
"address + i" and "data + i" are word aligned, so when the destination and
source share a non-zero misalignment the byte path advances i to the next
word boundary and the fast path then copies the wrong word, through an
unaligned 32-bit access that faults on the Cortex-M0+ of stm32l0.
Index both pointers by i directly, and cover the case the existing tests
deliberately avoided.
The byte-wise branch of hal_flash_write() derived the containing word from
the call-time "address" instead of the current position "address + i":
int off = (address + i) - (((address + i) >> 2) << 2);
dst = (uint32_t *)(address - off);
val = dst[i >> 2];
so "dst[i >> 2]" addressed physical byte "address - off + (i & ~3)". Any
iteration with "i" not a multiple of 4 modified the wrong byte, and with
off != 0 it did so through a misaligned 32-bit flash access (a HardFault on
the Cortex-M0+ of stm32l0). A word-aligned 6-byte write, for instance, put
data[5] at "address + 4" and left "address + 5" erased.
Use the form already applied to hal/samr21.c and hal/same51.c: base the
word on "address + i - off", read it with a single aligned access, and fill
it byte by byte up to the next word boundary.
Add unit-flash-write-nrf52, covering the aligned-with-tail, mismatched
alignment and single-word cases against hal/nrf52.c.
hal_flash_erase() in hal/mcxw.c rounded the start address down with the
runtime pflash_sector_size (queried from FLASH_GetProperty() in hal_init())
but stepped address and len by the compile-time WOLFBOOT_SECTOR_SIZE. When
the two differ, a larger WOLFBOOT_SECTOR_SIZE steps over hardware sectors
inside the requested range and leaves them unerased, while a smaller one
issues erase commands at non-sector-aligned addresses. A zero size reported
by the driver would also divide by zero.
Take a local sector_size, fall back to WOLFBOOT_SECTOR_SIZE when the driver
reports zero and use it for the alignment and both loop steps, as
hal/mcxn.c already does.
Add unit-flash-erase-mcxw, using the existing WOLFBOOT_UNIT_TEST_FLASH_ERASE
guard convention to compile hal_flash_erase() in isolation without the NXP
MCUXpresso SDK headers.
- wolfBoot_fit_memcpy: return int so a failed PDMA copy propagates instead
of being swallowed. The weak default (memcpy) returns 0; the MPFS250 PDMA
override returns -1 if any chunk's mpfs_pdma_memcpy() fails. Callers now
fail closed: fit_load_image_inner returns NULL (kernel load then panics
via update_disk.c), the update_disk DTS copy panics, and hal_dts_fixup
returns an error on a failed L2->DDR copy-back.
- options.mk: gate -DSTACK_SIZE_PER_HART behind RISC-V arch (RISCV/RISCV64).
The macro is only consumed by the RISC-V startup asm and the mpfs250-m.ld
sed token, so it is no longer emitted for PPC/ARM/other targets. The
unconditional default (?= 0) is kept because the linker sed always needs
a value to substitute.
Run wolfBoot on the PIC32CZ CA9x host core (Cortex-M7) as a wolfHSM client,
offloading the image digest (SHA-256) and the ECDSA P-256 signature check to
the wolfHSM server.
On STM32U5 the BKER bit in FLASH_NSCR/SECCR always selects the
physical bank: the SWAP_BANK option only changes the address mapping
of the banks (RM0456 7.5.8, and confirmed on silicon). hal_flash_erase
derived BKER from the logical address only, so with SWAP_BANK active
every page erase landed in the bank opposite to the one mapped at the
target address.
In DUALBANK_SWAP mode this broke fallback recovery: when image
verification failed while running from bank 2, wolfBoot_erase_partition
(PART_UPDATE) erased the healthy image in the active bank instead of
the failing update, leaving the device unable to boot. The same
mismatch corrupted any erase issued while swapped, including staging a
new update from the application.
Invert BKER when both DBANK and SWAP_BANK are set, mirroring the
STM32H5 HAL which already handles this (RM0481 has the same physical
bank semantics). STM32L5 is not affected: RM0438 defines NSBKER as the
page number MSB, which follows the mapped address.
Verified on the m33mu emulator with hardware-faithful BKER/SWAP_BANK
modeling: full cycle (update to bank 2, swap, stage corrupt update,
verify failure) now erases the corrupt update and falls back to the
healthy image; before this fix the healthy image was erased and the
device bricked.
The bulk FLASH_Program path read data+w but never advanced w, so a
partial-word tail after an aligned run re-read the input from offset 0.
Affects kinetis, mcxa, mcxw. Pin with an mcxa bulk+tail test case.
In the else branch of hal_flash_write, off was computed once per call from
the original (call-time) "address" instead of the current position
"address + i". The word index dst_idx advanced with i, but the fill loop
kept starting at the stale off, so once destination address and source
buffer had different alignment mod 4, every word after the first was
filled at the wrong byte offset, dropping and misplacing data. Derive off
and dst from address + i so each word's offset tracks the current
position, mirroring the fix already applied to mcxa.c for the same bug
class (F-5963).
hal_flash_write() and hal_flash_erase() aligned the invalidation start
address down to a 32-byte cache line but rounded the length up from
"len" alone, omitting the (address - aligned_address) offset. Whenever
(address % 32) + (len % 32) > 32, the invalidated range fell short of
address + len, leaving the last cache line stale after a write/erase.
Extract the range computation into hal_flash_cache_align_range()
(hal/imx_rt.h, dependency-free so it's unit-testable without the
NXP SDK) and include the down-alignment offset before rounding the
length up, so the invalidated range always covers [address, address+len).
In the unaligned/partial-word path, address/len were advanced by the full
flash-word-relative loop index "i" (which starts at start_off), instead of
by the number of data bytes actually consumed (i - start_off). On a write
spanning more than one flash word this drops start_off bytes of input data
and misdirects the following word write. Mirrors the already-correct form
in hal/kinetis_kl26.c.
Add wolfBoot support for booting VxWorks 7 SMP 64-bit (and signed ELF
images) on the NXP T2080 (e6500) / Curtiss-Wright VPX3-152.
Key fix: bring up the e6500 cluster L2 cache in the correct order -- set
L2PE (ECC) in its own polled write BEFORE enabling L2E, with L2FI|L2LFC --
matching CW U-Boot (SDK2.0). The previous bare-L2E init left the L2 ECC
array uninitialized for the kernel's 0x1E0000 set, machine-checking VxWorks
(MCSR[IF], L2ERRDET MBECC).
Also: ePAPR spin-table SMP bring-up of all four cores, ELF in-place loader
staging-overlap fix, DPAA/LIODN + QMan/BMan init, 64-bit OS handoff
(LAW/TLB/IVOR), and NAII 68PPC2 + CW VPX3-152 board configs.
In hal/va416x0.c, FRAM_Write now explicitly aborts the split SPI write transaction on command-phase failure before returning, instead of leaving the bus in the half-open state introduced
by the early return. I also added a host-side regression test in tools/unit-tests/unit-va416x0-fram.c that injects a command-phase HAL_Spi_Transmit(..., false) failure and verifies a later
write still reaches the closing ...true phase.
In src/arm_tee_psa_ipc.c, I extracted the protected-storage dispatch path into a small helper so it can be tested directly without changing runtime behavior. The new test in tools/unit-
tests/unit-arm-tee-psa-ipc.c covers the short-vector invalid-argument branches for SET, GET, GET_INFO, and REMOVE, plus a full success path across those operations. The unit harness
additions are wired up in tools/unit-tests/Makefile and use a tiny local CMSE stub in tools/unit-tests/arm_cmse.h.
WREN and address-phase return codes were silently overwritten by
subsequent assignments; a failed WREN would let the write proceed
with the WEL bit unset, causing a silently dropped write while
returning hal_status_ok. Add early-return checks after each transmit
phase in FRAM_Write and guard the subsequent calls in FRAM_Init.
boot_addr is uint32_t*, so (boot_addr + *size) advanced *size * 4 bytes
instead of *size bytes, overstating the MEMMAP_DEVICE_PATH range by 4x
relative to the SourceSize passed to LoadImage. Cast to uint8_t* first
so the addition is byte-accurate and consistent with the SourceSize argument.
No unit test: compiling hal/x86_64_efi.c in a host test requires stubbing
the complete UEFI SDK type tree (EFI_FILE_IO_INTERFACE, EFI_LOADED_IMAGE,
EFI_GUID, CHAR16, LibFileInfo, FreePool, InitializeLib, …) throughout the
file — disproportionate scaffolding for a one-line arithmetic fix.
Daniele Lacamera
David Garske
Marco Oliverio
Aidan Garske
Mattia Moffa
aidan garske
Alex Lanzano
Brett Nicholas