wolfBoot/tools/unit-tests/unit-nvm-cache-scrub.c

/* unit-nvm-cache-scrub.c
 *
 * Regression test: under NVM_FLASH_WRITEONCE the trailer helpers stage
 * a whole flash sector into NVM_CACHE, which in EXT_ENCRYPTED builds is
 * also where the firmware key and nonce live (ENCRYPT_CACHE aliases it).
 * Neither trailer_write() nor partition_magic_write() scrubbed it on
 * return, leaving the plaintext key in .bss across the handoff to the
 * application.
 *
 * Extracts the real helpers (generated by the Makefile) and runs them
 * with a test-owned NVM_CACHE, a staged sector carrying a key pattern
 * and stubbed flash calls; the buffer must be zero after each call.
 * Copyright (C) 2026 wolfSSL Inc.
 *
 * This file is part of wolfBoot.
 *
 * wolfBoot is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 3 of the License, or
 * (at your option) any later version.
 *
 * wolfBoot is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
 */

#include <check.h>
#include <stdint.h>
#include <stddef.h>
#include <string.h>

#define RAMFUNCTION
#define WOLFBOOT_SECTOR_SIZE 4096
#define NVM_CACHE_SIZE WOLFBOOT_SECTOR_SIZE
#define FLASHBUFFER_SIZE WOLFBOOT_SECTOR_SIZE
#define XMEMCPY(a, b, n) memcpy((a), (b), (n))

/* The buffer under test (real: file-scope in src/libwolfboot.c). */
static uint8_t NVM_CACHE[NVM_CACHE_SIZE];
static uint8_t nvm_cached_sector;

/* The staged sector image: a "flash" sector carrying the firmware
 * key/nonce pattern at a fixed offset. */
#define KEY_OFF 0x1000
#define KEY_LEN 64
static uint8_t g_sector[NVM_CACHE_SIZE];

/* Stubbed flash layer: records calls; g_fail_write makes the next
 * write fail (the staged key is already in NVM_CACHE at that point,
 * so the failure path must scrub too). */
static int g_flash_writes;
static int g_flash_erases;
static int g_fail_write;

int hal_flash_write(uint32_t address, const uint8_t *data, int len)
{
    (void)address; (void)data; (void)len;
    if (g_fail_write) {
        g_fail_write = 0;
        return -1;
    }
    g_flash_writes++;
    return 0;
}

int hal_flash_erase(uint32_t address, int len)
{
    (void)address; (void)len;
    g_flash_erases++;
    return 0;
}

int nvm_select_fresh_sector(int part)
{
    (void)part;
    return 0;
}

/* wolfboot_magic_trail: the 32-bit trailer magic (real: global in
 * src/libwolfboot.c). */
uint32_t wolfboot_magic_trail;

/* ForceZero: scrub the way wolfCrypt does (volatile, no elision). */
void ForceZero(void *data, size_t sz)
{
    volatile uint8_t *p = (volatile uint8_t *)data;
    while (sz > 0) {
        *p++ = 0;
        sz--;
    }
}

/* The real functions from src/libwolfboot.c (extracted by the
 * Makefile). */
#include "nvm_cache_scrub_extract.h"

static int cache_scrubbed(void)
{
    int i;

    for (i = 0; i < NVM_CACHE_SIZE; i++)
        if (NVM_CACHE[i] != 0)
            return 0;
    return 1;
}

static void stage_sector(void)
{
    memset(g_sector, 0x11, sizeof(g_sector));
    memset(g_sector + KEY_OFF, 0xA5, KEY_LEN); /* key/nonce pattern */
}

static void setup(void)
{
    stage_sector();
    memset(NVM_CACHE, 0, sizeof(NVM_CACHE));
    nvm_cached_sector = 0;
    g_flash_writes = 0;
    g_flash_erases = 0;
    g_fail_write = 0;
    wolfboot_magic_trail = 0x0000DEAD;
}

static void teardown(void)
{
}

/* partition_magic_write() must leave NVM_CACHE scrubbed on success.
 * Pre-fix the staged sector (key bytes at KEY_OFF) remained. */
START_TEST(test_magic_write_scrubs_cache)
{
    uintptr_t addr = (uintptr_t)g_sector + 0x40;

    ck_assert_int_eq(partition_magic_write(0, addr), 0);
    ck_assert_int_eq(g_flash_writes, 1);
    ck_assert_int_eq(g_flash_erases, 1);
    ck_assert_int_eq(cache_scrubbed(), 1);
}
END_TEST

/* trailer_write() must leave NVM_CACHE scrubbed on success. */
START_TEST(test_trailer_write_scrubs_cache)
{
    uintptr_t addr = (uintptr_t)g_sector + 0x20;

    ck_assert_int_eq(trailer_write(0, addr, 0x77), 0);
    ck_assert_int_eq(g_flash_writes, 1);
    ck_assert_int_eq(g_flash_erases, 2);
    ck_assert_int_eq(cache_scrubbed(), 1);
}
END_TEST

/* A failing flash write must still leave NVM_CACHE scrubbed: the
 * sector (key included) was staged into the buffer before the write
 * failed. */
START_TEST(test_failing_write_scrubs_cache)
{
    uintptr_t addr = (uintptr_t)g_sector + 0x40;

    g_fail_write = 1;
    ck_assert_int_eq(trailer_write(0, addr, 0x77), -1);
    ck_assert_int_eq(g_flash_writes, 0);
    ck_assert_int_eq(cache_scrubbed(), 1);
}
END_TEST

Suite *nvm_cache_scrub_suite(void)
{
    Suite *s = suite_create("nvm-cache-scrub");
    TCase *tc = tcase_create("nvm-cache-scrub");

    tcase_add_checked_fixture(tc, setup, teardown);
    tcase_add_test(tc, test_magic_write_scrubs_cache);
    tcase_add_test(tc, test_trailer_write_scrubs_cache);
    tcase_add_test(tc, test_failing_write_scrubs_cache);
    suite_add_tcase(s, tc);

    return s;
}

int main(void)
{
    int fails;
    Suite *s = nvm_cache_scrub_suite();
    SRunner *sr = srunner_create(s);

    srunner_run_all(sr, CK_NORMAL);
    fails = srunner_ntests_failed(sr);
    srunner_free(sr);

    return fails;
}