WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity
wolfBoot/tools/unit-tests
History
Daniele Lacamera 0412238414 F-11044: stage the fwTPM command in secure memory before processing 
wcs_fwtpm_transmit() verified that cmd identifies non-secure memory
and then passed that mutable buffer directly to FWTPM_ProcessCommand.
The processor parses the packet more than once (authentication, then
handler execution), so a DMA-capable non-secure attacker who rewrites
the command buffer in the window between the two parses can make the
authenticated command differ from the executed command.

Copy exactly cmdSz bytes into a secure staging buffer after the range
validation and invoke the processor only on that copy: an NS DMA
master cannot rewrite secure memory, so both parses see the same
bytes. The command and response staging are zeroed before returning
(the response may carry auth tags or unsealed data).

unit-fwtpm-cmd-toctou includes the real fwtpm_callable.c and mocks
FWTPM_ProcessCommand with two parse points (authentication,
execution). The test plays the attacker, rewriting the NS command
buffer at the window between the parses - the mock may only touch the
caller's buffer, never secure staging, mirroring the hardware
boundary. Pre-fix the processor authenticated the original bytes and
executed the rewritten ones (test fails); post-fix both parses see
the original command.

Verification:
- Built: unit tests compile the real veneer (host, poisoned fwtpm
  headers, same pattern as unit-fwtpm-nv-oob).
- Tested: unit-fwtpm-cmd-toctou 2/2 (red demonstrated against the
  pre-fix veneer via git stash of the fix); sibling
  unit-fwtpm-rsp-overrun 3/3 and unit-fwtpm-nv-oob 4/4 after the
  change.
- Pitfalls: the staging copy happens after all NS range checks and
  before any processor access; zeroing covers the full staging
  buffers regardless of the produced length.
- Style: cstyle-check.sh flag count on src/fwtpm_callable.c unchanged
  (1 pre-existing); the new test trips only the uncrustify
  pointer-alignment class the sibling unit tests trip.
- Message: F-11044: prefix, no co-author trailers.
- Unverified: no CMSE/armclang build and no m33mu emulator run here
  (lib/wolftpm is not checked out in this tree); the trustzone-emulator
  workflow covers the full build on push.
 		2026-08-25 08:51:09 +02:00
..
cc26x2_ti_stub tests: cover cc26x2 flash error propagation 2026-08-17 15:59:35 +02:00
mcxa_fsl_stub F-5963: fix over-advance of address/len in unaligned hal_flash_write (kinetis.c, mcxa.c, mcxw.c) 2026-07-02 14:47:38 +02:00
Makefile F-11044: stage the fwTPM command in secure memory before processing 2026-08-25 08:51:09 +02:00
README.md
…
arm_cmse.h F-7389: arm_tee: reject Secure .base in zero-length PSA iovecs 2026-08-04 07:02:53 +02:00
gpt-sfdisk-test.h
…
target.h
…
txt_filler.h
…
unit-ahci-unlock-panic.c F-6129: zeroize disk-unlock secret before the state-mismatch panic in sata_unlock_disk 2026-07-02 14:18:03 +02:00
unit-arm-tee-psa-ipc.c F-7389: arm_tee: reject Secure .base in zero-length PSA iovecs 2026-08-04 07:02:53 +02:00
unit-ata-security-passphrase-zeroize.c F-5968: zeroize disk-unlock passphrase from static ATA command buffer 2026-07-02 14:27:04 +02:00
unit-aurix-erased-fill.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-boot-x86_fsp.c
…
unit-cm4-rauc-slot.c Fixes from skoll review findings 2026-08-24 12:47:34 +02:00
unit-cm4-sdhci.c cm4: add wolfCrypt FIPS 140-3 support + CI, SDHCI unit test, review fixes 2026-08-24 12:47:34 +02:00
unit-common.c
…
unit-delta.c F-5965: skip wb_diff match candidates whose offset MSB collides with ESC 2026-07-02 14:35:07 +02:00
unit-diagnostics.c Diagnostics: move to next sector when last record is broken 2026-07-02 17:53:12 +02:00
unit-dice-token-size.c Add wolfCOSE DICE attestation 2026-08-06 09:44:52 +02:00
unit-disk.c F-4258: reject GPT partitions whose LBA extent overflows uint64_t 2026-06-10 21:01:16 +02:00
unit-ecc-raw-der.c F-11024: pass full-width fields to wc_ecc_rs_raw_to_sig in the wolfHSM verify path 2026-08-25 08:50:42 +02:00
unit-efi-x86-open-image.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-elf-bss-guard.c fix broken unit test 2026-06-16 16:11:10 -06:00
unit-elf-entry-inplace.c elf: read the ELF entry point before loading segments over it 2026-08-25 08:46:40 +02:00
unit-elf-mmu-fail.c F-11027: abort the ELF load when an mmu_cb mapping fails 2026-08-25 08:51:09 +02:00
unit-enc-nvm.c Fix hwswap fallback CI regressions 2026-07-02 18:57:55 +02:00
unit-extflash.c add unaligned fallback-IV RMW test for ext_flash_encrypt_write 2026-08-21 09:03:18 +02:00
unit-fdt.c F-9757: length-bound the FIT name/compression string properties 2026-08-21 08:52:59 +02:00
unit-fit-fpga.c Add wolfBoot FIT support for loading bitstream 2026-06-09 15:30:27 +02:00
unit-fit-gzip.c F-9757: length-bound the FIT name/compression string properties 2026-08-21 08:52:59 +02:00
unit-flash-erase-c0.c F-3963: fix hal_flash_erase loop bound in stm32c0.c skipping final partial page 2026-06-11 18:16:48 +02:00
unit-flash-erase-g0.c F-3964: fix hal_flash_erase loop bound in stm32g0.c skipping final partial page 2026-06-11 18:13:30 +02:00
unit-flash-erase-h7.c F-5745: fix off-by-one in hal_flash_erase skipping last page when len%PAGE_SIZE!=0 2026-06-10 21:01:16 +02:00
unit-flash-erase-l0.c F-3965: fix hal_flash_erase loop bound in stm32l0.c skipping final partial page 2026-06-11 18:08:22 +02:00
unit-flash-erase-mcxw.c mcxw: extend the erase length when rounding the start down 2026-08-12 13:21:08 +02:00
unit-flash-erase-u3.c F-3962: fix hal_flash_erase loop bound in stm32u3.c skipping final partial page 2026-06-11 18:23:51 +02:00
unit-flash-erase-wb.c F-3966: fix hal_flash_erase loop bound in stm32wb.c skipping final partial page 2026-06-11 18:02:03 +02:00
unit-flash-write-cc26x2.c Remove tracker ids from code, condense comments 2026-08-18 19:48:12 +02:00
unit-flash-write-mcxa.c hal: advance source index in aligned flash-write fast path 2026-07-02 17:01:08 +02:00
unit-flash-write-nrf52.c nrf52/nrf5340/stm32l0: fix the 32-bit fast path in hal_flash_write 2026-08-12 13:20:56 +02:00
unit-flash-write-same51.c F-5964: fix stale in-word offset in hal_flash_write byte-wise path (samr21/same51) 2026-07-02 15:57:54 +02:00
unit-flash-write-samr21.c F-5964: fix stale in-word offset in hal_flash_write byte-wise path (samr21/same51) 2026-07-02 15:57:54 +02:00
unit-fwtpm-cmd-toctou.c F-11044: stage the fwTPM command in secure memory before processing 2026-08-25 08:51:09 +02:00
unit-fwtpm-nv-oob.c F-5092: fix off-by-one in fwtpm_nv_read/write/erase offset guard 2026-06-10 21:01:16 +02:00
unit-fwtpm-rsp-overrun.c F-11043: stage the fwTPM response before copying to the caller buffer 2026-08-25 08:51:09 +02:00
unit-fwtpm-stub.c
…
unit-gzip.c
…
unit-hifive1-flash-write.c F-11035: size the final partial page from remaining bytes in hifive1 write 2026-08-25 08:51:09 +02:00
unit-image-elf-scatter.c bound the ELF paddr range check by the destination pointer width 2026-08-21 08:57:46 +02:00
unit-image.c Authenticate raw device tree via signed HDR_DEVICE_TREE_DIGEST TLV (Fenrir #7998) 2026-08-13 08:39:22 +02:00
unit-imx-rt-cache-align.c F-6399: fix imx_rt DCACHE invalidation to include down-alignment offset 2026-07-02 15:13:28 +02:00
unit-keygen-xmss-params.c
…
unit-keystore.c
…
unit-linux-loader-e820.c F-4711: bound e820 entries to prevent boot_params stack overflow 2026-06-05 19:19:05 +02:00
unit-linux-loader-syssize.c Fix test regression, addressed copilot comments 2026-06-05 20:55:52 +02:00
unit-loader-tpm-init.c
…
unit-ls1028a-xspi-write.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-max-space.c
…
unit-mock-flash.c libwolfboot: propagate the head-block write failure 2026-08-12 13:20:56 +02:00
unit-mock-state.c
…
unit-mpusize.c F-5132: complete mpusize() table so MPU stays enabled for >64KB wolfBoot 2026-06-09 15:52:07 +02:00
unit-multiboot.c F-4651: bound multiboot2 header_length to prevent OOB tag walk 2026-06-10 21:01:16 +02:00
unit-nvm-cache-scrub.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-nvm.c Address PR #815 review comments 2026-07-02 19:20:34 +02:00
unit-otp-keystore-gen-zeroize.c F-6408: zeroize UDS from OTP keystore generator's heap and stack buffers 2026-07-02 14:56:48 +02:00
unit-otp-keystore.c F-3734: add unit tests for magic check and item_count boundary in flash_otp_keystore 2026-06-11 19:13:49 +02:00
unit-p1021-erase-advance.c F-11034: advance the address in the P1021 multi-block NAND erase loop 2026-08-25 08:51:09 +02:00
unit-p1021-fcm-bytes.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-p1021-qe-firmware.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-parser-large-header.c F-6762: compare the TLV field budget in a 32-bit domain 2026-08-21 08:52:59 +02:00
unit-parser.c
…
unit-pci.c 6561 - Restore upper 64-bit BAR register on pci_program_bar error paths 2026-07-14 17:44:26 +02:00
unit-pic32-pfswap.c 6560 - Clear PFSWAP bit in pic32_fcw_pfswap_set read-modify-write 2026-07-21 19:33:40 +02:00
unit-pkcs11-nsc-zeroize.c F-6875: pkcs11: zeroize NSC bounce buffers before freeing them 2026-08-04 08:26:17 +02:00
unit-pkcs11_store.c F-4649: erase pkcs11_store object sectors on write-mode open to clear residual key material 2026-06-10 21:01:16 +02:00
unit-policy-create.c
…
unit-policy-sign.c
…
unit-psa_store.c F-6407: zeroize static cached_sector after each flash commit in psa_store 2026-07-02 14:03:24 +02:00
unit-qspi-flash.c F-7382: clip QSPI page program transfers at the device page boundary 2026-08-11 12:54:36 +02:00
unit-rot-auth.c F-4973: clamp TPM-supplied nvPublic.dataSize before NV read-back in rot.c 2026-06-09 15:52:07 +02:00
unit-sama5d3-ext-read.c bad-blocks: keep skipping cumulative 2026-08-24 12:38:47 +02:00
unit-sdhci-disk-unaligned.c Peer review fixes (thanks Jack) 2026-08-24 12:47:34 +02:00
unit-sdhci-dma-error.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-sdhci-response-bits.c
…
unit-sdhci-uhs-recover.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-sdhci-wait-busy.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-sectorflags.c
…
unit-sign-custom-tlv-large.py fix bad max value in test print 2026-07-22 16:26:58 -06:00
unit-sign-custom-tlv-le.py F-6127: fix custom-TLV 8-byte value saturation in arg2num 2026-07-02 15:28:09 +02:00
unit-sign-custom-tlv-pubkey-der.py Check key len for truncation; add unit test 2026-07-30 15:38:11 +02:00
unit-sign-delta-basehash-cleanup.py F-8006: return errors from delta base-hash validation in sign tool 2026-08-11 09:13:31 +02:00
unit-sign-delta-cert-inv-off.py Address Copilot review comments 2026-06-09 15:52:07 +02:00
unit-sign-delta-tlv.py F-5352: emit 4-byte delta size TLVs from Python signer 2026-06-09 15:50:48 +02:00
unit-sign-dts.py Authenticate raw device tree via signed HDR_DEVICE_TREE_DIGEST TLV (Fenrir #7998) 2026-08-13 08:39:22 +02:00
unit-sign-encrypted-output.c
…
unit-sign-encrypted-output.mkfrag
…
unit-sign-header-failure.c F-7053: sign: propagate make_header() failure to the exit status 2026-08-04 08:16:53 +02:00
unit-sign-hybrid-keyload.c F-8003: separate decoded key objects for hybrid signers 2026-08-11 09:25:54 +02:00
unit-spi-flash.c
…
unit-stm32g4-write.c F-11023: require a full double word in the STM32 fast write paths 2026-08-25 08:50:42 +02:00
unit-stm32l5-write.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-stm32u5-write.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-store-sbrk.c
…
unit-string.c
…
unit-t10xx-dts-memac.c F-9758: validate FDT layout in fdt_check_header, use it in fdt_get_string 2026-08-21 08:52:59 +02:00
unit-t10xx-flash-status.c F-11033: propagate program/erase timeouts from the T10xx flash HAL 2026-08-25 08:51:09 +02:00
unit-t10xx-qe-firmware.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-t2080-fman-loader.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-ti-hercules-write.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-tpm-advio-zeroize.c F-8007: wipe TPM advanced-IO staging buffers in TPM2_IoCb() 2026-08-11 12:23:09 +02:00
unit-tpm-api-names.c
…
unit-tpm-blob.c F-3738: fix policySz uint16_t underflow in wolfBoot_unseal_blob for short policy 2026-06-11 18:30:49 +02:00
unit-tpm-check-rot-auth.c
…
unit-tpm-mfgid-eh-zeroize.c F-7069: clear the EH authValue from the stack in wolfBoot_tpm2_get_timestamp 2026-08-11 12:59:01 +02:00
unit-tpm-nsc-cert.c F-7065: tpm: snapshot NS length in wolfBoot_tpm2_read_cert veneer 2026-08-04 08:07:18 +02:00
unit-tpm-rsa-exp.c F-6402: add negative tests pinning wolfBoot_check_rot digest comparison 2026-07-02 14:10:44 +02:00
unit-uart-flash.c
…
unit-ubootenv.c Peer review fixes (thanks Daniele) 2026-08-24 12:47:34 +02:00
unit-update-disk-fit.c F-7066: bound the FIT DTS relocation copy to the staging size 2026-08-21 08:52:59 +02:00
unit-update-disk-oob.c update_disk.c: enforce bound over memcpy 2026-06-23 17:28:25 +02:00
unit-update-disk.c update_disk: use wc_ForceZero() in the DISK_ENCRYPT helpers 2026-08-11 13:59:06 +02:00
unit-update-flash-hwswap.c Fix hwswap fallback CI regressions 2026-07-02 18:57:55 +02:00
unit-update-flash.c F-9751: Add positive E2E encrypted-update test, fix what it exposes 2026-08-21 08:52:59 +02:00
unit-update-ram-enc.c test/ram-enc: add exact-max and one-block-over boundary tests 2026-06-18 11:26:15 +02:00
unit-update-ram-nofixed.c F-3972: add direction-sensitive unit tests for wolfBoot_dualboot_candidate_addr 2026-06-11 17:44:52 +02:00
unit-update-ram-noramboot.c F-4410: fix uint32_t->int cast bypassing anti-rollback in update_ram wolfBoot_start 2026-06-11 17:31:35 +02:00
unit-update-ram-uboot.c F-7985: enter legacy uImage at ih_ep when it differs from ih_load 2026-08-11 12:16:39 +02:00
unit-update-ram.c F-11028: panic when both RAM-boot images fail verification 2026-08-25 08:51:09 +02:00
unit-va416x0-fram.c F-7051: return the hal_status_t unmodified from FRAM_Erase 2026-08-18 03:32:21 +02:00
unit-versal-ext-write.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-versal-qspi-dma.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-wolfhsm_flash_hal.c Add WOLFCRYPT_TZ_WOLFHSM TrustZone engine for STM32H5 2026-06-24 15:49:43 -07:00
unit-x86-paging-oob.c F-5093: fix OOB memset in x86_paging_setup_ptp and non-looping panic 2026-06-10 21:01:16 +02:00
unit-xspi-tfd-index.c 6588 - Index LS1028A XSPI TX FIFO by word instead of by byte 2026-07-21 19:33:40 +02:00
unit-zynq-erase-loop.c Condense the verbose comments 2026-08-18 20:12:06 +02:00
unit-zynq-ext-write.c Condense the verbose comments 2026-08-18 20:12:06 +02:00

README.md

Unit Test Tools

This uses the "check" unit test framework for C.

You may need to run "apt install check", "yum install check" or "brew install check".

Building

Use make to build.

Expected output

$ ./unit-parser
Running suite(s): wolfBoot
Explicit end of options reached
This field is too large (bigger than the space available in the current header)
This field is too large and would overflow the image header
Illegal address (too high)
Illegal address (too high)
100%: Checks: 2, Failures: 0, Errors: 0