Fenrir fixes 2026 06 11

.gitignore

@@ -185,6 +185,8 @@ tools/unit-tests/unit-update-flash-self-update
 tools/unit-tests/unit-update-flash-hook
 tools/unit-tests/unit-loader-tpm-init
 tools/unit-tests/unit-update-ram-nofixed
+tools/unit-tests/unit-update-ram-noramboot
+tools/unit-tests/unit-update-flash-hwswap
 tools/unit-tests/unit-uart-flash
 tools/unit-tests/unit-max-space
 tools/unit-tests/unit-sdhci-disk-unaligned
@@ -200,6 +202,15 @@ tools/unit-tests/unit-mpusize
 tools/unit-tests/unit-otp-keystore
 tools/unit-tests/unit-tpm-api-names
 tools/unit-tests/unit-elf-bss-guard
+tools/unit-tests/unit-fit-fpga
+tools/unit-tests/unit-flash-erase-c0
+tools/unit-tests/unit-flash-erase-g0
+tools/unit-tests/unit-flash-erase-l0
+tools/unit-tests/unit-flash-erase-u3
+tools/unit-tests/unit-flash-erase-wb
+tools/unit-tests/unit-fwtpm-nv-oob
+tools/unit-tests/unit-x86-paging-oob
+
 
 
 # Elf preprocessing tools

hal/stm32c0.c

@@ -20,18 +20,24 @@
  */
 
 #include <stdint.h>
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #include <image.h>
+#endif
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #ifndef NVM_FLASH_WRITEONCE
 #   error "wolfBoot STM32C0 HAL: no WRITEONCE support detected. Please define NVM_FLASH_WRITEONCE"
 #endif
+#endif
 
 /* STM32 C0 register configuration */
 
 /* Assembly helpers */
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #define DMB() __asm__ volatile ("dmb")
 #define ISB() __asm__ volatile ("isb")
 #define DSB() __asm__ volatile ("dsb")
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
 
 /*** RCC ***/
@@ -65,12 +71,14 @@
 #define SYSCFG_APB2_CLOCK_ER_VAL    (1 << 0) /* RM0490 - 5.4.14 - RCC_APBENR2 - SYSCFGEN */
 
 #define FLASH_BASE          (0x40022000)  /*FLASH_R_BASE = 0x40000000UL + 0x00020000UL + 0x00002000UL */
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #define FLASH_ACR           (*(volatile uint32_t *)(FLASH_BASE + 0x00)) /* RM0490 - 3.7.1 - FLASH_ACR */
 #define FLASH_KEY           (*(volatile uint32_t *)(FLASH_BASE + 0x08)) /* RM0490 - 3.7.2 - FLASH_KEYR */
 #define FLASH_OPTKEY        (*(volatile uint32_t *)(FLASH_BASE + 0x0C)) /* RM0490 - 3.7.3 - FLASH_OPTKEYR */
 #define FLASH_SR            (*(volatile uint32_t *)(FLASH_BASE + 0x10)) /* RM0490 - 3.7.4 - FLASH_SR */
 #define FLASH_CR            (*(volatile uint32_t *)(FLASH_BASE + 0x14)) /* RM0490 - 3.7.5 - FLASH_CR */
 #define FLASH_SECR          (*(volatile uint32_t *)(FLASH_BASE + 0x80)) /* RM0490 - 3.7.13 - FLASH_SECR */
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
 #define FLASHMEM_ADDRESS_SPACE (0x08000000)
 #define FLASH_PAGE_SIZE        (0x800) /* 2KB */
@@ -108,6 +116,7 @@
 #define FLASH_OPTKEY2                         (0x4C5D6E7F)
 
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 static void RAMFUNCTION flash_set_waitstates(unsigned int waitstates)
 {
     uint32_t reg, mask_val, set_val;
@@ -191,6 +200,7 @@ void RAMFUNCTION hal_flash_lock(void)
     if ((FLASH_CR & FLASH_CR_LOCK) == 0)
         FLASH_CR |= FLASH_CR_LOCK;
 }
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
 
 int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
@@ -199,7 +209,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     uint32_t p;
     if (len == 0)
         return -1;
-    end_address = address + len - 1;
+    end_address = address + len;
     for (p = address; p < end_address; p += FLASH_PAGE_SIZE) {
         uint32_t reg = FLASH_CR & (~(FLASH_CR_PNB_MASK << FLASH_CR_PNB_SHIFT));
         FLASH_CR = reg | ((p >> FLASH_PAGE_SIZE_SHIFT) << FLASH_CR_PNB_SHIFT) | FLASH_CR_PER;
@@ -211,6 +221,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     return 0;
 }
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 static void clock_pll_off(void)
 {
     uint32_t reg32;
@@ -308,3 +319,4 @@ void RAMFUNCTION hal_prepare_boot(void)
     do_secure_boot();
 #endif
 }
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */

hal/stm32g0.c

@@ -20,18 +20,24 @@
  */
 
 #include <stdint.h>
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #include <image.h>
+#endif
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #ifndef NVM_FLASH_WRITEONCE
 #   error "wolfBoot STM32G0 HAL: no WRITEONCE support detected. Please define NVM_FLASH_WRITEONCE"
 #endif
+#endif
 
 /* STM32 G0 register configuration */
 
 /* Assembly helpers */
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #define DMB() __asm__ volatile ("dmb")
 #define ISB() __asm__ volatile ("isb")
 #define DSB() __asm__ volatile ("dsb")
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
 
 /*** RCC ***/
@@ -63,11 +69,13 @@
 #define SYSCFG_APB2_CLOCK_ER_VAL    (1 << 0) /* RM0444 - 5.4.15 - RCC_APBENR2 - SYSCFGEN */
 
 #define FLASH_BASE          (0x40022000)  /*FLASH_R_BASE = 0x40000000UL + 0x00020000UL + 0x00002000UL */
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #define FLASH_ACR           (*(volatile uint32_t *)(FLASH_BASE + 0x00)) /* RM0444 - 3.7.1 - FLASH_ACR */
 #define FLASH_KEY           (*(volatile uint32_t *)(FLASH_BASE + 0x08)) /* RM0444 - 3.7.2 - FLASH_KEYR */
 #define FLASH_SR            (*(volatile uint32_t *)(FLASH_BASE + 0x10)) /* RM0444 - 3.7.4 - FLASH_SR */
 #define FLASH_CR            (*(volatile uint32_t *)(FLASH_BASE + 0x14)) /* RM0444 - 3.7.5 - FLASH_CR */
 #define FLASH_SECR          (*(volatile uint32_t *)(FLASH_BASE + 0x80)) /* RM0444 - 3.7.12 - FLASH_SECR */
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
 #define FLASHMEM_ADDRESS_SPACE (0x08000000)
 #define FLASH_PAGE_SIZE     (0x800) /* 2KB */
@@ -103,6 +111,7 @@
 #define FLASH_KEY2                            (0xCDEF89AB)
 
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 static void RAMFUNCTION flash_set_waitstates(unsigned int waitstates)
 {
     uint32_t reg = FLASH_ACR;
@@ -181,6 +190,7 @@ void RAMFUNCTION hal_flash_lock(void)
     if ((FLASH_CR & FLASH_CR_LOCK) == 0)
         FLASH_CR |= FLASH_CR_LOCK;
 }
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
 
 int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
@@ -190,7 +200,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     if (len == 0)
         return -1;
     address -= FLASHMEM_ADDRESS_SPACE;
-    end_address = address + len - 1;
+    end_address = address + len;
     for (p = address; p < end_address; p += FLASH_PAGE_SIZE) {
         while (FLASH_SR & (FLASH_SR_BSY1 | FLASH_SR_BSY2));
         flash_clear_errors();
@@ -210,6 +220,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     return 0;
 }
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 static void clock_pll_off(void)
 {
     uint32_t reg32;
@@ -356,3 +367,4 @@ void RAMFUNCTION hal_prepare_boot(void)
     do_secure_boot();
 #endif
 }
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */

hal/stm32h5.c

@@ -182,6 +182,14 @@ __attribute__((weak)) int stm32h5_obkeys_read_uds(uint8_t *out, size_t out_len)
 #endif
 
 #if defined(WOLFCRYPT_TZ_PSA)
+static NOINLINEFUNCTION void hal_secret_zeroize(void *ptr, size_t len)
+{
+    volatile uint8_t *p = (volatile uint8_t *)ptr;
+    while (len-- > 0U) {
+        *p++ = 0U;
+    }
+}
+
 static int uds_from_uid(uint8_t *out, size_t out_len)
 {
     uint8_t uid[12];
@@ -231,6 +239,8 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
         copy_len = out_len;
     }
     memcpy(out, digest, copy_len);
+    hal_secret_zeroize(digest, sizeof(digest));
+    hal_secret_zeroize(&hash, sizeof(hash));
     return 0;
 }
 
@@ -246,14 +256,6 @@ static int buffer_is_all_value(const uint8_t *buf, size_t len, uint8_t value)
     return 1;
 }
 
-static NOINLINEFUNCTION void hal_secret_zeroize(void *ptr, size_t len)
-{
-    volatile uint8_t *p = (volatile uint8_t *)ptr;
-    while (len-- > 0U) {
-        *p++ = 0U;
-    }
-}
-
 int hal_uds_derive_key(uint8_t *out, size_t out_len)
 {
 #if defined(FLASH_OTP_KEYSTORE)

hal/stm32l0.c

@@ -20,11 +20,15 @@
  */
 
 #include <stdint.h>
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #include <image.h>
+#endif
 /* STM32 L0 register configuration */
 
 /* Assembly helpers */
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #define DMB() __asm__ volatile ("dmb")
+#endif
 
 /*** RCC ***/
 
@@ -49,11 +53,13 @@
 #define PWR_APB1_CLOCK_ER_VAL   (1 << 28)
 #define FLASH_BASE          (0x40022000)
 #define FLASH_ACR           (*(volatile uint32_t *)(FLASH_BASE + 0x00))
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #define FLASH_PECR          (*(volatile uint32_t *)(FLASH_BASE + 0x04))
 #define FLASH_PEKEY         (*(volatile uint32_t *)(FLASH_BASE + 0x0c))
 #define FLASH_PRGKEY        (*(volatile uint32_t *)(FLASH_BASE + 0x10))
 #define FLASH_SR            (*(volatile uint32_t *)(FLASH_BASE + 0x18))
 #define FLASHMEM_ADDRESS_SPACE (0x08000000)
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 #define FLASH_PAGE_SIZE     (128)
 
 /* Register values */
@@ -73,6 +79,7 @@
 #define FLASH_PECR_ERASE                      (1 << 9)
 
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 static void RAMFUNCTION flash_set_waitstates(unsigned int waitstates)
 {
     if (waitstates && ((FLASH_ACR & 1) == 0))
@@ -82,6 +89,7 @@ static void RAMFUNCTION flash_set_waitstates(unsigned int waitstates)
     while ((FLASH_ACR & 1) != waitstates)
         ;
 }
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
 static RAMFUNCTION void flash_wait_complete(void)
 {
@@ -94,6 +102,7 @@ static void RAMFUNCTION clear_errors(void)
     FLASH_SR |= ( FLASH_SR_SIZERR | FLASH_SR_PGAERR | FLASH_SR_WRPERR |  FLASH_SR_EOP );
 }
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
 {
     int i = 0;
@@ -151,6 +160,7 @@ void RAMFUNCTION hal_flash_lock(void)
     if ((FLASH_PECR & FLASH_PECR_PRGLOCK) == 0)
         FLASH_PECR |= FLASH_PECR_PRGLOCK;
 }
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
 
 int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
@@ -159,7 +169,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     uint32_t p;
     if (len == 0)
         return -1;
-    end_address = address + len - 1;
+    end_address = address + len;
     for (p = address; p < end_address; p += FLASH_PAGE_SIZE) {
         FLASH_PECR |= FLASH_PECR_PROG | FLASH_PECR_ERASE;
         *(volatile uint32_t *)(p + FLASHMEM_ADDRESS_SPACE)  = 0xFFFFFFFF;
@@ -169,6 +179,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     return 0;
 }
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 static void clock_pll_off(void)
 {
     uint32_t reg32;
@@ -270,4 +281,4 @@ void hal_prepare_boot(void)
     clock_pll_off();
 #endif
 }
-
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */

hal/stm32l5.c

@@ -120,6 +120,14 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
 #define STM32L5_UID2 (*(volatile uint32_t *)(STM32L5_UID_BASE + 0x8))
 
 #if defined(WOLFCRYPT_TZ_PSA)
+static NOINLINEFUNCTION void hal_secret_zeroize(void *ptr, size_t len)
+{
+    volatile uint8_t *p = (volatile uint8_t *)ptr;
+    while (len-- > 0U) {
+        *p++ = 0U;
+    }
+}
+
 static int uds_from_uid(uint8_t *out, size_t out_len)
 {
     uint8_t uid[12];
@@ -173,6 +181,8 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
         copy_len = out_len;
     }
     memcpy(out, digest, copy_len);
+    hal_secret_zeroize(digest, sizeof(digest));
+    hal_secret_zeroize(&hash, sizeof(hash));
     return 0;
 }
 

hal/stm32u3.c

@@ -27,13 +27,16 @@
  */
 
 #include <stdint.h>
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 #include <image.h>
 #include <string.h>
-#include "hal/stm32u3.h"
 #include "hal.h"
 #include "printf.h"
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
+#include "hal/stm32u3.h"
 
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 static void RAMFUNCTION flash_set_waitstates(unsigned int waitstates)
 {
     uint32_t reg = FLASH_ACR;
@@ -148,6 +151,7 @@ void RAMFUNCTION hal_flash_opt_lock(void)
     if ((FLASH_NS_CR & FLASH_CR_OPTLOCK) == 0)
         FLASH_NS_CR |= FLASH_CR_OPTLOCK;
 }
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
 /* Erase — matches STM32U5 hal pattern exactly (same Cortex-M33 flash controller) */
 int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
@@ -161,7 +165,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     if (address < ARCH_FLASH_OFFSET)
         return -1;
 
-    end_address = address + len - 1;
+    end_address = address + len;
     for (p = address; p < end_address; p += FLASH_PAGE_SIZE) {
         uint32_t reg;
         uint32_t bker = 0;
@@ -194,6 +198,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     return 0;
 }
 
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_ERASE
 /* --- UART: USART1 on PA9 (TX) / PA10 (RX), AF7 --- */
 
 #define USART1_BASE         (0x40013800U)
@@ -356,3 +361,4 @@ void RAMFUNCTION hal_cache_invalidate(void)
         ;
     ICACHE_SR |= ICACHE_SR_BSYENDF;
 }
+#endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */