Merge pull request #814 from danielinux/fenrir-fixes-2026-07-02

Fenrir fixes 2026 07 02

Author: dgarske

.gitignore

@@ -200,6 +200,7 @@ tools/unit-tests/unit-linux-loader-e820
 tools/unit-tests/unit-linux-loader-syssize
 tools/unit-tests/unit-mpusize
 tools/unit-tests/unit-otp-keystore
+tools/unit-tests/unit-otp-keystore-gen-zeroize
 tools/unit-tests/unit-tpm-api-names
 tools/unit-tests/unit-elf-bss-guard
 tools/unit-tests/unit-fit-fpga
@@ -210,6 +211,20 @@ tools/unit-tests/unit-flash-erase-u3
 tools/unit-tests/unit-flash-erase-wb
 tools/unit-tests/unit-fwtpm-nv-oob
 tools/unit-tests/unit-x86-paging-oob
+tools/unit-tests/unit-ahci-unlock-panic
+tools/unit-tests/unit-ata-security-passphrase-zeroize
+tools/unit-tests/unit-arm-tee-psa-ipc
+tools/unit-tests/unit-flash-write-mcxa
+tools/unit-tests/unit-flash-write-same51
+tools/unit-tests/unit-flash-write-samr21
+tools/unit-tests/unit-image-elf-scatter
+tools/unit-tests/unit-image-hybrid
+tools/unit-tests/unit-imx-rt-cache-align
+tools/unit-tests/unit-update-disk-oob
+tools/unit-tests/unit-update-ram-enc
+tools/unit-tests/unit-update-ram-enc-nopart
+tools/unit-tests/unit-va416x0-fram
+tools/unit-tests/unit-wolfhsm_flash_hal
 
 
 

hal/imx_rt.c

@@ -26,6 +26,7 @@
 #include <target.h>
 #include "image.h"
 #include "printf.h"
+#include "imx_rt.h"
 #include "fsl_cache.h"
 #include "fsl_common.h"
 #include "fsl_iomuxc.h"
@@ -966,8 +967,8 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
      * (see definition of DCACHE_InvalidateByRange).
      * To ensure all data is included we align the address downwards, and the length upwards.
      */
-    uint32_t aligned_address = address - (address % 32);
-    uint32_t aligned_len = len + (32 - (len % 32));
+    uint32_t aligned_address, aligned_len;
+    hal_flash_cache_align_range(address, (uint32_t)len, &aligned_address, &aligned_len);
     DCACHE_InvalidateByRange(aligned_address, aligned_len);
     /* Re-enable interrupts */
     asm volatile("cpsie i");
@@ -1010,8 +1011,8 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
      * (see definition of DCACHE_InvalidateByRange).
      * To ensure all data is included we align the address downwards, and the length upwards.
      */
-    uint32_t aligned_address = address - (address % 32);
-    uint32_t aligned_len = len + (32 - (len % 32));
+    uint32_t aligned_address, aligned_len;
+    hal_flash_cache_align_range(address, (uint32_t)len, &aligned_address, &aligned_len);
     DCACHE_InvalidateByRange(aligned_address, aligned_len);
     /* Re-enable interrupts */
     asm volatile("cpsie i");

hal/imx_rt.h

@@ -0,0 +1,46 @@
+/* imx_rt.h
+ *
+ * Support routines for the i.MX RT HAL, kept free of NXP MCUXpresso SDK
+ * dependencies so they can be exercised directly in the host unit tests.
+ *
+ * Copyright (C) 2026 wolfSSL Inc.
+ *
+ * This file is part of wolfBoot.
+ *
+ * wolfBoot is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfBoot is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+#ifndef IMX_RT_H
+#define IMX_RT_H
+
+#include <stdint.h>
+
+/* Flash is memory mapped, so after a program/erase, the affected range must
+ * be invalidated in the data cache to ensure coherency. The cache line size
+ * is 32 bytes, so both the address and length passed to
+ * DCACHE_InvalidateByRange() must be 32-byte aligned: the address is rounded
+ * down, and the length is rounded up by the same down-alignment offset plus
+ * "len", so that the invalidated range always fully covers
+ * [address, address + len). */
+static inline void hal_flash_cache_align_range(uint32_t address, uint32_t len,
+        uint32_t *aligned_address, uint32_t *aligned_len)
+{
+    uint32_t start = address - (address % 32);
+    uint32_t unaligned_len = len + (address - start);
+
+    *aligned_address = start;
+    *aligned_len = unaligned_len + ((32 - (unaligned_len % 32)) % 32);
+}
+
+#endif /* IMX_RT_H */

hal/kinetis.c

@@ -330,13 +330,14 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
                 if (ret != kStatus_FTFx_Success)
                     return -1;
             }
-            address += i;
-            len -= i;
+            address = address_align + i;
+            len -= (int)(i - start_off);
         } else {
             uint32_t len_align = len - (len & 0x07);
             ret = FLASH_Program(&pflash, address, (uint8_t*)data + w, len_align);
             if (ret != kStatus_FTFx_Success)
                 return -1;
+            w += len_align;
             len -= len_align;
             address += len_align;
         }

hal/mcxa.c

@@ -93,14 +93,15 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
                 if (ret != kStatus_Success)
                     return -1;
             }
-            address += i;
-            len -= i;
+            address = address_align + i;
+            len -= (int)(i - start_off);
         }
         else {
             uint32_t len_align = len - (len & 0x0F);
             ret = FLASH_ProgramPhrase(&pflash, address, (uint8_t*)data + w, len_align);
             if (ret != kStatus_Success)
                 return -1;
+            w += len_align;
             len -= len_align;
             address += len_align;
         }

hal/mcxw.c

@@ -155,7 +155,7 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
     int w = 0;
     const uint32_t flash_word_size = 16;
     const uint32_t empty_qword[4] = {
-        0xFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF
+        0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF
     };
 
     while (len > 0) {
@@ -172,8 +172,8 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
             if (memcmp(aligned_qword, empty_qword, flash_word_size) != 0) {
                 write_flash_qword((uint32_t *)address_align, aligned_qword);
             }
-            address += i;
-            len -= i;
+            address = address_align + i;
+            len -= (int)(i - start_off);
         }
         else {
             uint32_t i;
@@ -183,6 +183,7 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
                 write_flash_qword((uint32_t *)(address + i),
                                   (const uint32_t *)(data + w + i));
             }
+            w += len_align;
             len -= len_align;
             address += len_align;
         }

hal/same51.c

@@ -280,7 +280,9 @@ void hal_init(void)
     /* Turn off watchdog */
     WDT_CTRL &= (~WDT_EN);
     /* Run the bootloader with interrupts off */
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_WRITE
     __asm__ volatile ("cpsid i");
+#endif
 
     /* Initialize clock */
     clock_init();
@@ -357,17 +359,16 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
         } else {
             uint32_t val;
             uint8_t *vbytes = (uint8_t *)(&val);
-            uint32_t off = (address % 4);
-            dst = (uint32_t *)(address - off);
-            uint32_t dst_idx = (i + off) >> 2;
-            val = dst[dst_idx];
+            uint32_t off = ((address + i) % 4);
+            dst = (uint32_t *)(address + i - off);
+            val = *dst;
             while (off < 4) {
                 if (i < len)
                     vbytes[off++] = data[i++];
                 else
                     off++;
             }
-            dst[dst_idx] = val;
+            *dst = val;
         }
         if ((i == len) || ((i % 16)== 0))
             NVMCTRLB = (NVMCMD_WQW | NVMCMD_KEY);

hal/samr21.c

@@ -106,7 +106,9 @@ void hal_init(void)
 {
 
     WDT_CTRL &= (~WDT_EN);
+#ifndef WOLFBOOT_UNIT_TEST_FLASH_WRITE
     __asm__ volatile ("cpsid i");
+#endif
     uint32_t i, reg;
     /* enable clocks for the power, sysctrl and gclk modules */
     APBAMASK_REG = APBAMASK_PM_EN | APBAMASK_SYSCTRL_EN | APBAMASK_GCLK_EN;
@@ -176,17 +178,16 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
         } else {
             uint32_t val;
             uint8_t *vbytes = (uint8_t *)(&val);
-            uint32_t off = (address % 4);
-            dst = (uint32_t *)(address - off);
-            uint32_t dst_idx = (i + off) >> 2;
-            val = dst[dst_idx];
+            uint32_t off = ((address + i) % 4);
+            dst = (uint32_t *)(address + i - off);
+            val = *dst;
             while (off < 4) {
                 if (i < len)
                     vbytes[off++] = data[i++];
                 else
                     off++;
             }
-            dst[dst_idx] = val;
+            *dst = val;
         }
     }
     /* Enable write protection */

options.mk

@@ -181,6 +181,7 @@ endif
 
 ## DSA Settings
 ifeq ($(SIGN),NONE)
+  $(warning SIGN=NONE / WOLFBOOT_NO_SIGN=1 disables firmware signature verification; images are NOT authenticated. Do not use in production.)
   SIGN_OPTIONS+=--no-sign
   ifeq ($(HASH),SHA384)
     STACK_USAGE=3760
@@ -1003,6 +1004,7 @@ WOLFBOOT_LOAD_FPGA_ADDRESS ?= 0
 # logged warning that continues the boot.
 FPGA_NONFATAL ?= 0
 ifeq ($(FPGA_NONFATAL),1)
+  $(warning FPGA_NONFATAL=1 continues booting when the FPGA bitstream fails to load; the device may run without security-relevant programmable logic)
   CFLAGS+=-DWOLFBOOT_FPGA_NONFATAL
 endif
 # FIT_CONFIG_SELECT=1 lets the target pick a per-board FIT configuration

src/delta.c

@@ -303,6 +303,15 @@ int wb_diff(WB_DIFF_CTX *ctx, uint8_t *patch, uint32_t len)
                 blk_start = pa - ctx->src_a;
                 if (blk_start > BLOCK_OFF_MAX)
                     return -1;
+                if (((blk_start >> 16) & 0xFF) == ESC) {
+                    /* The most-significant offset byte would collide with
+                     * the escaped-literal marker (ESC ESC), making the
+                     * header indistinguishable from a literal ESC byte on
+                     * decode. Skip this candidate and keep searching.
+                     */
+                    pa++;
+                    continue;
+                }
                 b_start = ctx->off_b;
                 pa+= BLOCK_HDR_SIZE;
                 ctx->off_b += BLOCK_HDR_SIZE;
@@ -367,6 +376,13 @@ int wb_diff(WB_DIFF_CTX *ctx, uint8_t *patch, uint32_t len)
                     blk_start = pb - ctx->src_b;
                     if (blk_start > BLOCK_OFF_MAX)
                         return -1;
+                    if (((blk_start >> 16) & 0xFF) == ESC) {
+                        /* Same ESC-collision hazard as the forward-match
+                         * path: skip this candidate and keep searching.
+                         */
+                        pb++;
+                        continue;
+                    }
                     pb+= BLOCK_HDR_SIZE;
                     ctx->off_b += BLOCK_HDR_SIZE;
                     while ((pb < pb_limit) &&