[aidangarske]

• With TZEN=1 the SAU opened the update partition, the flash controller, RNG, PUF, DMA, the crypto blocks and AHB_SECURE_CTR to the non-secure app, and the AHB secure controller was never programmed or locked.
• The SAU now opens only the boot partition, SRAM2, FLEXCOMM0 and GPIO. AHB secure controller rules cover flash, ROM, every SRAM bank and the peripheral bridges, secure checking is on, and both the SAU and the controller are write-locked until reset. LED pins are handed to the app in periph_unsecure(), so IOCON stays secure.
• Flash driver: PRIMASK is saved and restored around every ROM call, every return code is checked, erased pages are filled from the start of flash (attestation hashes it) through the keyvault, fsl_iap runs from RAM so wolfBoot can update itself, no
• HW PUF record is word aligned and read through the HAL flash accessor. New unit-lpc55s69-puf covers erased, all-0xFF, committed, foreign commit word, erased payload and interrupted commit or payload writes.
• hal_get_timer_us for BOOT_BENCHMARK, TRNG only in secure mode with a ready flag, DSP and Arm asm enabled in all configs, new
  hal/lpc55s69.h, test-app linker fixes (RAM length, heap), TARGET_lpc55s69 ifdefs removed from startup_arm.c,
  wolfcrypt_support.c and user_settings.h.
• Tests and CI: unit-lpc55s69-flash, -tz, -uart and -puf; lpc55s69-emulator-tests.yml runs boot, update and rollback for
  lpc55s69 and lpc55s69-tz; trustzone-emulator-tests.yml boots PKCS11 and HWPUF twice with --persist and checks the objects and the UEID survive; five new build jobs including non-TZ HWPUF=1. The --persist
• Docs: LPC55S69 section reworked with the pyOCD flow, flash layout tables and a TrustZone section; .cmm scripts use relative paths and the right addresses.
• Tested on LPCXpresso55S69 with pyOCD: update, rollback and self-update (non-TZ), update and rollback (TZ), 13 secure addresses fault from the NS app while SRAM2, FLEXCOMM0 and GPIO read, PKCS11 persistence, PSA attestation, DEBUG_UART=0 boots, benchmark config 31/31. Emulator and unit tests pass locally; Skoll review + review-security clean.
• Added Docs on Puf and updated flash steps for the board

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #950

Scan targets checked: wolfboot-src, wolfboot-bugs
Not reviewed (no scan target covers them): .github/workflows/lpc55s69-emulator-tests.yml, .github/workflows/test-configs.yml, .github/workflows/trustzone-emulator-tests.yml, .gitignore, arch.mk, config/examples/lpc55s69-benchmark.config, config/examples/lpc55s69-tz-psa.config, config/examples/lpc55s69-tz.config, config/examples/lpc55s69.config, docs/Targets.md, hal/lpc55s69-ns.ld, hal/lpc55s69.h, hal/lpc55s69.ld, options.mk, test-app/ARM-lpc55s69-ns.ld, test-app/ARM-lpc55s69.ld, test-app/Makefile, test-app/emu-test-apps/Makefile, test-app/emu-test-apps/lpc55s69/Makefile, test-app/emu-test-apps/lpc55s69/target.ld.in and 7 more
Coverage: 7 of 9 in-scope changed file(s) opened by the reviewer; not opened: test-app/emu-test-apps/common/emu_hal.c, test-app/emu-test-apps/lpc55s69/uart.c

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[dgarske]

@twcook86 can you review this work as well?

[twcook86]

The other thing on my list I meant to circle back to is setting of the secure stack limit, so the stack doesn't accidentally grow into wolfboot bss space. This is the msplim register in the m33. If I remember correctly, there was another platform that sets it to the end of bss space. Just checked, yes, it's in boot_arm.c.