Batch of Fenrir fixes: 2026 09 24

.gitignore

@@ -563,3 +563,71 @@ fs_b.img
 tools/unit-tests/aarch64_arch_host.h
 tools/unit-tests/imx8qm_usdhc_extract.h
 tools/unit-tests/imx8qm_flexspi_extract.h
+# unit-test binaries added since the last gitignore pass
+tools/unit-tests/unit-ct-compare
+tools/unit-tests/unit-custom-trailer-nopart
+tools/unit-tests/unit-ecc-raw-der
+tools/unit-tests/unit-elf-mmu-fail
+tools/unit-tests/unit-elf-phentsize
+tools/unit-tests/unit-fdt-memrsv-wrap
+tools/unit-tests/unit-flash-erase-kinetis
+tools/unit-tests/unit-flash-m2354
+tools/unit-tests/unit-fwtpm-cmd-toctou
+tools/unit-tests/unit-fwtpm-rsp-overrun
+tools/unit-tests/unit-hifive1-flash-write
+tools/unit-tests/unit-hifive1-hfrosccfg
+tools/unit-tests/unit-keygen-keystore
+tools/unit-tests/unit-kontron-tgl-spi
+tools/unit-tests/unit-nrf5340-flash-protect
+tools/unit-tests/unit-nrf5340-uart-crlf
+tools/unit-tests/unit-nrf54l-uart-write
+tools/unit-tests/unit-nsc-update
+tools/unit-tests/unit-p1021-erase-advance
+tools/unit-tests/unit-p1021-read-badblock
+tools/unit-tests/unit-pci-4gib
+tools/unit-tests/unit-pkcs11-pin-zeroize
+tools/unit-tests/unit-pkcs11_store-stalecache
+tools/unit-tests/unit-rp2350-flash-write
+tools/unit-tests/unit-samr21-erase-advance
+tools/unit-tests/unit-sdhci-acmd41-timeout
+tools/unit-tests/unit-secure-handoff
+tools/unit-tests/unit-stm32c0-write
+tools/unit-tests/unit-stm32g4-write
+tools/unit-tests/unit-stm32h7-flash-write
+tools/unit-tests/unit-stm32l4-write
+tools/unit-tests/unit-stm32u3-flash-write
+tools/unit-tests/unit-stm32wb-write
+tools/unit-tests/unit-t10xx-flash-status
+tools/unit-tests/unit-ti-hercules-erase
+tools/unit-tests/unit-update-disk-fsp
+tools/unit-tests/unit-update-ram-custom-trailer
+tools/unit-tests/unit-update-ram-nofixed-noramboot
+tools/unit-tests/unit-update-trigger-scrub
+tools/unit-tests/unit-x86-uart
+# sources generated by the unit-test extraction rules
+tools/unit-tests/ct_compare_extract.h
+tools/unit-tests/fdt_memrsv_extract.h
+tools/unit-tests/hifive1_flash_write_extract.h
+tools/unit-tests/hifive1_hfrosccfg_extract.h
+tools/unit-tests/keystore_api_extract.h
+tools/unit-tests/keystore_emitted.c
+tools/unit-tests/keystore_gen
+tools/unit-tests/kinetis_erase_extract.h
+tools/unit-tests/kontron_spi_extract.h
+tools/unit-tests/kontron_spi_fn_extract.h
+tools/unit-tests/nrf5340_protect_fn_extract.h
+tools/unit-tests/nrf54l_uart_write_extract.h
+tools/unit-tests/p1021_erase_extract.h
+tools/unit-tests/p1021_erase_fn_extract.h
+tools/unit-tests/p1021_read_extract.h
+tools/unit-tests/p1021_read_fn_extract.h
+tools/unit-tests/rp2350_flash_write_extract.h
+tools/unit-tests/stm32c0_write_extract.h
+tools/unit-tests/stm32g4_write_extract.h
+tools/unit-tests/stm32h7_flash_write_extract.h
+tools/unit-tests/stm32l4_write_extract.h
+tools/unit-tests/stm32u3_flash_write_extract.h
+tools/unit-tests/stm32wb_write_extract.h
+tools/unit-tests/t10xx_flash_status_extract.h
+tools/unit-tests/ti_hercules_erase_extract.h
+tools/unit-tests/versal_host_write.c

CMakeLists.txt

@@ -794,7 +794,7 @@ endif()
 #---------------------------------------------------------------------------------------------
 if(SIGN STREQUAL "NONE")
     list(APPEND KEYTOOL_OPTIONS --no-sign)
-    message(STATUS "Image signing disabled")
+    message(WARNING "SIGN=NONE / WOLFBOOT_NO_SIGN=1 disables firmware signature verification; images are NOT authenticated. Do not use in production.")
     set(WOLFBOOT_SIGNING_PRIVATE_KEY
         ""
         CACHE INTERNAL "")
@@ -1023,6 +1023,7 @@ if(EXT_FLASH)
 endif()
 
 if(ALLOW_DOWNGRADE)
+    message(WARNING "ALLOW_DOWNGRADE=1 disables anti-rollback enforcement; signed older firmware images can replace newer ones")
     list(APPEND WOLFBOOT_DEFS ALLOW_DOWNGRADE)
 endif()
 
@@ -1031,6 +1032,7 @@ if(NVM_FLASH_WRITEONCE)
 endif()
 
 if(DISABLE_BACKUP)
+    message(WARNING "DISABLE_BACKUP=1 disables power-fail-safe updates; losing power during an update can leave BOOT partially written and unrecoverable")
     list(APPEND WOLFBOOT_DEFS DISABLE_BACKUP)
 endif()
 

hal/hifive1.c

@@ -137,7 +137,7 @@
 #define HFROSCCFG_TRIM           0x001F0000UL
 #define HFROSCCFG_EN             (1UL << 30UL)
 #define HFROSCCFG_READY          (1UL << 31UL)
-#define HFROSCCFG_DIV_SHIFT(d)   ((d << 0) & HFROSCCFG_TRIM)
+#define HFROSCCFG_DIV_SHIFT(d)   ((d << 0) & HFROSCCFG_DIV)
 #define HFROSCCFG_TRIM_SHIFT(t)  ((t << 16) & HFROSCCFG_TRIM)
 
 #define HFXOSCCFG_EN             (1 << 30)
@@ -485,6 +485,10 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
     uint8_t data_copy[FLASH_PAGE_SIZE];
     int swmode = 0;
 
+    if (len < 0)
+        return -1;
+    if (len == 0)
+        return 0;
 
     if (address >= FLASH_BASE)
         address -= FLASH_BASE;
@@ -573,8 +577,14 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
 {
     uint32_t end;
     uint32_t p;
-    if (address >= FLASH_BASE)
+
+    /* A non-positive length would underflow the inclusive end below. */
+    if (len <= 0) {
+        return 0;
+    }
+    if (address >= FLASH_BASE) {
         address -= FLASH_BASE;
+    }
     end = address + len - 1;
 
     FESPI_REG_TXMARK = 1;

hal/kinetis.c

@@ -358,13 +358,18 @@ void RAMFUNCTION hal_flash_lock(void)
 int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
 {
     int idx = 0;
+
     do_flash_init();
-    do {
+    /* Pre-test guard: a do/while would erase one full sector for a
+     * zero/negative length request. */
+    if (len <= 0)
+        return -1;
+    while (len > 0) {
         if (FLASH_Erase(&pflash, address + WOLFBOOT_SECTOR_SIZE * idx, WOLFBOOT_SECTOR_SIZE, kFTFx_ApiEraseKey) != kStatus_FTFx_Success)
             return -1;
         len -= WOLFBOOT_SECTOR_SIZE;
         idx++;
-    } while (len > 0);
+    }
     FTFx_CACHE_ClearCachePrefetchSpeculation(&pcache, 1);
     return 0;
 }

hal/mcxa.c

@@ -120,9 +120,14 @@ void RAMFUNCTION hal_flash_lock(void)
 
 int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
 {
+    if (len <= 0)
+        return -1;
     while ((address % 4) != 0)
-        address --;
-    if (FLASH_EraseSector(&pflash, address, len, kFLASH_ApiEraseKey) != kStatus_Success)
+        address--;
+    /* FLASH_EraseSector takes the length in bytes (4-byte aligned),
+     * not a sector count (MCXA ROM API, fsl_romapi.h). */
+    if (FLASH_EraseSector(&pflash, address, (uint32_t)len, kFLASH_ApiEraseKey)
+            != kStatus_Success)
         return -1;
     return 0;
 }

hal/nrf54l.c

@@ -111,22 +111,29 @@ void uart_write_device(int device, const char* buf, unsigned int sz)
 {
     static char buffer[UART_WRITE_BUF_SIZE];
     int bufsz = 0;
+    int i;
 
-    for (int i = 0; i < (int)sz && bufsz < UART_WRITE_BUF_SIZE; i++) {
+    for (i = 0; i < (int)sz; i++) {
         char ch = (char) buf[i];
 
         if (ch == '\r')
             continue;
 
         if (ch == '\n') {
-            if (bufsz >= (UART_WRITE_BUF_SIZE - 1))
-                break;
-
+            if (bufsz >= (UART_WRITE_BUF_SIZE - 1)) {
+                uart_write_raw(device, buffer, bufsz);
+                bufsz = 0;
+            }
             buffer[bufsz++] = '\r';
         }
+        if (bufsz >= UART_WRITE_BUF_SIZE) {
+            uart_write_raw(device, buffer, bufsz);
+            bufsz = 0;
+        }
         buffer[bufsz++] = ch;
     }
-    uart_write_raw(device, buffer, bufsz);
+    if (bufsz > 0)
+        uart_write_raw(device, buffer, bufsz);
 }
 
 void uart_write(const char* buf, unsigned int sz)

hal/nxp_ls1028a.c

@@ -780,13 +780,17 @@ static int test_flash(void)
     /* Erase sector */
     ret = ext_flash_erase(TEST_ADDRESS, WOLFBOOT_SECTOR_SIZE);
     wolfBoot_printf("Erase Sector: Ret %d\n", ret);
+    if (ret < 0)
+        return -1;
 
     /* Write Pages */
     for (i=0; i<sizeof(pageData); i++) {
         pageData[i] = (i & 0xff);
     }
     ret = ext_flash_write(TEST_ADDRESS, pageData, sizeof(pageData));
     wolfBoot_printf("Write Page: Ret %d\n", ret);
+    if (ret < 0)
+        return -1;
 
     /* Read page */
     memset(pageData, 0, sizeof(pageData));
@@ -799,12 +803,12 @@ static int test_flash(void)
         wolfBoot_printf("check[%3d] %02x\n", i, pageData[i]);
         if (pageData[i] != (i & 0xff)) {
             wolfBoot_printf("Check Data @ %d failed\n", i);
-            return -i;
+            return -1;
         }
     }
 
     wolfBoot_printf("Flash Test Passed\n");
-    return ret;
+    return 0;
 }
 #endif /* TEST_EXT_FLASH */
 
@@ -951,7 +955,9 @@ void hal_init(void)
     wolfBoot_printf("Flash init done\n");
 
 #ifdef TEST_EXT_FLASH
-    test_flash();
+    if (test_flash() != 0) {
+        wolfBoot_printf("External flash test FAILED\n");
+    }
 #endif
 
 #ifdef TPM_TEST

hal/rtl8735b.c

@@ -104,6 +104,14 @@ extern void wolfboot_ram_entry(void);
 static uint8_t hal_bl_scratch[2048]
     __attribute__((section(".ram.noinit"), aligned(32)));
 
+/* The bootloader writes seven fixed slots into hal_bl_scratch at 256-byte
+ * strides; the last one (phal_spic_adaptor) gets the remaining 512 bytes.
+ * The SDK struct sizes are only known in the SDK backend -- when SPIC
+ * adaptor reuse is enabled, re-derive the slots from sizeof() of the real
+ * structs and keep this budget check. */
+typedef char hal_bl_scratch_budget_check[
+    (sizeof(hal_bl_scratch) >= 6 * 256 + 512) ? 1 : -1];
+
 /* Exactly the 10 bytes "AmebaPro2\xff" (the trailing 0xff matters; a NUL pad
  * fails as "Invalid FW Image Signature"). */
 const unsigned char hal_ram_img_sig[10]
@@ -433,9 +441,28 @@ void ext_flash_lock(void)
 #endif
 }
 
-int ext_flash_read(uintptr_t address, uint8_t *data, int len)
+/* Physical SPI NOR capacity (16 MB) -- the ext_flash_* window. */
+#define RTL8735B_EXT_FLASH_SIZE 0x1000000
+
+/* All ext_flash callers derive (address, len) from the partition layout in
+ * target.h; reject anything past the device end before it reaches the SDK. */
+static int ext_flash_in_layout(uintptr_t address, int len)
 {
     if (len < 0) {
+        return 0;
+    }
+    if ((uint32_t)address >= RTL8735B_EXT_FLASH_SIZE) {
+        return 0;
+    }
+    if ((uint32_t)len > RTL8735B_EXT_FLASH_SIZE - (uint32_t)address) {
+        return 0;
+    }
+    return 1;
+}
+
+int ext_flash_read(uintptr_t address, uint8_t *data, int len)
+{
+    if (!ext_flash_in_layout(address, len)) {
         return -1;
     }
     if (len == 0) {
@@ -459,7 +486,7 @@ int ext_flash_read(uintptr_t address, uint8_t *data, int len)
 
 int ext_flash_write(uintptr_t address, const uint8_t *data, int len)
 {
-    if (len < 0) {
+    if (!ext_flash_in_layout(address, len)) {
         return -1;
     }
     if (len == 0) {
@@ -485,7 +512,7 @@ int ext_flash_erase(uintptr_t address, int len)
     uint32_t sector_addr;
     uint32_t end_addr;
 
-    if (len < 0 || (uint32_t)len > UINT32_MAX - (uint32_t)address) {
+    if (!ext_flash_in_layout(address, len)) {
         return -1;
     }
     if (len == 0) {

hal/same51.c

@@ -352,9 +352,9 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
     NVMCTRLB  = (NVMCMD_PBC | NVMCMD_KEY);
     while (i < len) {
         if ((len - i > 3) && ((((address + i) & 0x03) == 0)  && ((((uint32_t)data) + i) & 0x03) == 0)) {
-            dst = (uint32_t *)address;
-            src = (uint32_t *)data;
-            dst[i >> 2] = src[i >> 2];
+            dst = (uint32_t *)(address + i);
+            src = (uint32_t *)(data + i);
+            *dst = *src;
             i+=4;
         } else {
             uint32_t val;

hal/samr21.c

@@ -174,9 +174,9 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
     NVMCTRLA_REG  = (NVMCMD_PBC | NVMCMD_KEY);
     while (i < len) {
         if ((len - i > 3) && ((((address + i) & 0x03) == 0)  && ((((uint32_t)data) + i) & 0x03) == 0)) {
-            dst = (uint32_t *)address;
-            src = (uint32_t *)data;
-            dst[i >> 2] = src[i >> 2];
+            dst = (uint32_t *)(address + i);
+            src = (uint32_t *)(data + i);
+            *dst = *src;
             i+=4;
         } else {
             uint32_t val;

hal/sim.c

@@ -343,8 +343,10 @@ static int mmap_file(const char *path, uint8_t *address, uint8_t** ret_address)
 
     mmaped_addr = mmap(address, st.st_size, PROT_READ | PROT_WRITE,
                        MAP_SHARED, fd, 0);
-    if (mmaped_addr == MAP_FAILED)
+    if (mmaped_addr == MAP_FAILED) {
+        close(fd);
         return -1;
+    }
 
     wolfBoot_printf( "Simulator assigned %s to base %p\n", path, mmaped_addr);
 

hal/stm32c0.c

@@ -80,6 +80,8 @@
 #define FLASH_SECR          (*(volatile uint32_t *)(FLASH_BASE + 0x80)) /* RM0490 - 3.7.13 - FLASH_SECR */
 #endif /* !WOLFBOOT_UNIT_TEST_FLASH_ERASE */
 
+#define FLASHMEM_ADDRESS_SPACE (0x08000000)
+
 #define FLASH_PAGE_SIZE        (0x800) /* 2KB */
 #define FLASH_PAGE_SIZE_SHIFT  11  /* (1 << FLASH_PAGE_SIZE_SHIFT) == FLASH_PAGE_SIZE*/
 
@@ -207,10 +209,12 @@ int RAMFUNCTION hal_flash_erase(uint32_t address, int len)
     uint32_t p;
     if (len == 0)
         return -1;
+    address -= FLASHMEM_ADDRESS_SPACE;
     end_address = address + len;
     for (p = address; p < end_address; p += FLASH_PAGE_SIZE) {
         uint32_t reg = FLASH_CR & (~(FLASH_CR_PNB_MASK << FLASH_CR_PNB_SHIFT));
-        FLASH_CR = reg | ((p >> FLASH_PAGE_SIZE_SHIFT) << FLASH_CR_PNB_SHIFT) | FLASH_CR_PER;
+        FLASH_CR = reg | (((p >> FLASH_PAGE_SIZE_SHIFT) & FLASH_CR_PNB_MASK) <<
+                FLASH_CR_PNB_SHIFT) | FLASH_CR_PER;
         DMB();
         FLASH_CR |= FLASH_CR_STRT;
         flash_wait_complete();

hal/stm32f4.c

@@ -251,7 +251,7 @@ int RAMFUNCTION hal_flash_erase(uint32_t _address, int len)
         if ((end_address >= flash_sector[i]) && (end_address < flash_sector[i + 1])) {
             end = i;
         }
-        if (start > 0 && end > 0)
+        if (start >= 0 && end >= 0)
             break;
     }
     if (start < 0 || end < 0)

hal/stm32g0.c

@@ -142,11 +142,11 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
         flash_clear_errors();
         if ((len - i >= 8) && ((((address + i) & 0x07) == 0) &&
                 ((((uint32_t)data) + i) & 0x07) == 0)) {
-            src = (uint32_t *)data;
-            dst = (uint32_t *)address;
+            src = (uint32_t *)(data + i);
+            dst = (uint32_t *)(address + i);
             flash_wait_complete();
-            dst[i >> 2] = src[i >> 2];
-            dst[(i >> 2) + 1] = src[(i >> 2) + 1];
+            dst[0] = src[0];
+            dst[1] = src[1];
             flash_wait_complete();
             i+=8;
         } else {