Skip to content

Harden wolfTrust service isolation and recovery - #22

Merged
mattia-moffa merged 41 commits into
wolfSSL:mainfrom
aidangarske:fenrir-fixes-14095-14127
Oct 1, 2026
Merged

Harden wolfTrust service isolation and recovery#22
mattia-moffa merged 41 commits into
wolfSSL:mainfrom
aidangarske:fenrir-fixes-14095-14127

Conversation

@aidangarske

@aidangarske aidangarske commented Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Member 
F-14097, F-14098, F-14096, F-14111, F-14114, F-14104, F-14112, F-14118, 
F-14124, F-14125, F-14119, F-14122, F-14123, F-14095, F-14109, F-14126, 
F-14127, F-14108, F-14101, F-14102, F-14120, F-14121, F-14117, F-14107, 
F-14099, F-14100, F-14106

Copilot AI lite review requested due to automatic review settings September 23, 2026 00:24
@aidangarske aidangarske changed the title Address Low and Info Fenrir findings Harden wolfTrust service isolation and recovery Sep 23, 2026
@aidangarske aidangarske self-assigned this Sep 23, 2026

This comment was marked as resolved.

Sign in to view

wolfSSL-Fenrir-bot
wolfSSL-Fenrir-bot previously requested changes Sep 23, 2026
View reviewed changes

@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fenrir Automated Review — PR #22

Scan targets checked: wolftrust-src, wolftrust-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Comment thread src/services/wolfhsm/wt_hsm.c Outdated
@aidangarske
aidangarske requested review from wolfSSL-Fenrir-bot and a lite review from Copilot September 23, 2026 16:07
wolfSSL-Fenrir-bot

This comment was marked as resolved.

Sign in to view

This comment was marked as resolved.

Sign in to view

@aidangarske
aidangarske requested review from wolfSSL-Fenrir-bot and a lite review from Copilot September 23, 2026 17:04
wolfSSL-Fenrir-bot
wolfSSL-Fenrir-bot reviewed Sep 23, 2026
View reviewed changes

@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fenrir Automated Review — PR #22

Scan targets checked: wolftrust-src, wolftrust-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

@wolfSSL-Fenrir-bot
wolfSSL-Fenrir-bot dismissed stale reviews from themself September 23, 2026 17:15

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

This comment was marked as resolved.

Sign in to view

@aidangarske
aidangarske marked this pull request as ready for review September 23, 2026 18:05
@aidangarske
aidangarske force-pushed the fenrir-fixes-14095-14127 branch from e2d0df3 to 64581e9 Compare September 30, 2026 16:18
@aidangarske aidangarske added the ci:all Run every M33MU scenario of every port on the PR (core change) label Sep 30, 2026
@aidangarske
aidangarske force-pushed the fenrir-fixes-14095-14127 branch from 64581e9 to c9f2a8d Compare September 30, 2026 17:42
@aidangarske aidangarske added ci:all Run every M33MU scenario of every port on the PR (core change) and removed ci:all Run every M33MU scenario of every port on the PR (core change) labels Sep 30, 2026
@aidangarske
F-14108 - Release IPC resources on quarantine
bd769d0
@aidangarske
F-14101 - Address the Non-secure NVIC banks
a424c1c
@aidangarske
F-14102 - Support the full Secure IRQ range
504a823
@aidangarske
F-14120 - Erase flash programming words
696be66
@aidangarske
F-14121 - Erase flash read-back buffers
1faaa9d
@aidangarske
F-14117 - Pad unaligned firmware update writes
03806c6
@aidangarske
F-14107 - Preserve FWU state when disarm fails
02eaf74
@aidangarske
F-14099 - Erase vault request and plaintext buffers
7971342
@aidangarske
F-14100 - Erase storage request and plaintext buffers
e11d10f
@aidangarske
F-14106 - Preserve sealed removal and reject key deletion
f752dfb
@aidangarske
F-14106 - Cover sealed deletion recovery
1303542
@aidangarske
F-14111 - Cover queued mutex handoff
316d252
@aidangarske
F-14123 - Preserve HSM fault canary
849197b
@aidangarske
F-14117 - Cover padded FWU writes
97b8895
@aidangarske
F-14107 - Cover failed FWU disarm
7effa55
@aidangarske
F-14127 - Keep guest RAM clearing word-efficient
be6183b
@aidangarske
F-14100 - Keep full buffer clearing responsive
fd179ea
@aidangarske
F-14109 - Reset and latch guest SysTick safely
2226982
@aidangarske
F-14118 - Preserve relay flow while clearing packets
143023a
@aidangarske
F-14111 - Correct lock-wait diagnostic comment
6de4635
@aidangarske
F-14123 - Keep HSM tasklet faults contained
d8b5d76
@aidangarske
F-14106 - Preserve keys during sealed delete recovery
cb90aa4
@aidangarske
Reject key deletion through vault storage remove
9d30f4e
@aidangarske
Wipe a faulted wolfHSM tasklet stack through the SPM-private stack mo…
3faf8f4 
…dule
@aidangarske
aidangarske force-pushed the fenrir-fixes-14095-14127 branch from 80e1a47 to 3faf8f4 Compare October 1, 2026 15:24
@aidangarske aidangarske added ci:all Run every M33MU scenario of every port on the PR (core change) and removed ci:all Run every M33MU scenario of every port on the PR (core change) labels Oct 1, 2026
@mattia-moffa
mattia-moffa merged commit 03b67ae into wolfSSL:main Oct 1, 2026
168 of 254 checks passed
@aidangarske
aidangarske deleted the fenrir-fixes-14095-14127 branch October 1, 2026 16:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot wolfSSL-Fenrir-bot left review comments
@mattia-moffa mattia-moffa mattia-moffa approved these changes
@danielinux danielinux Awaiting requested review from danielinux

Assignees

@danielinux danielinux

@aidangarske aidangarske

Labels

ci:all Run every M33MU scenario of every port on the PR (core change)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@aidangarske @mattia-moffa @wolfSSL-Fenrir-bot @danielinux