Harden wolfTrust service isolation and recovery - #22

Merged

mattia-moffa merged 41 commits into

wolfSSL:mainfrom

aidangarske:fenrir-fixes-14095-14127

Oct 1, 2026

Commits on Oct 1, 2026

F-14097 - Correct boot pointer-validation comment
aidangarske
committed
94d1d05
F-14098 - Clarify VNET RX token exposure
aidangarske
committed
428f17f
F-14096 - Correct secure partition privilege comments
aidangarske
committed
b6ef58e
F-14111 - Make queued mutex acquisition idempotent
aidangarske
committed
ac7ce64
F-14114 - Check active coroutine stack canaries
aidangarske
committed
b5ae318
F-14104 - Panic on invalid wait output pointers
aidangarske
committed
b8a584b
F-14112 - Dispatch runnable lock waiters
aidangarske
committed
79cce87
F-14118 - Erase shared HSM relay buffers
aidangarske
committed
87caad9
F-14124 - Erase HSM client response buffers
aidangarske
committed
4437d7f
F-14125 - Erase storage client request copies
aidangarske
committed
d58af40
F-14119 - Erase per-guest HSM relay buffers
aidangarske
committed
6dde2f5
F-14122 - Erase HSM state during relay recovery
aidangarske
committed
93b0b0b
F-14123 - Erase HSM tasklet state on fault
aidangarske
committed
c2b30f7
F-14095 - Correct HSM fault notification comments
aidangarske
committed
beba8d7
F-14109 - Restore residual virtual SysTick period
aidangarske
committed
30e3bc5
F-14126 - Scrub restart-clear RAM before quarantine
aidangarske
committed
f1d60ab
F-14127 - Erase non-word-aligned guest RAM tails
aidangarske
committed
e34bf46
F-14108 - Release IPC resources on quarantine
aidangarske
committed
bd769d0
F-14101 - Address the Non-secure NVIC banks
aidangarske
committed
a424c1c
F-14102 - Support the full Secure IRQ range
aidangarske
committed
504a823
F-14120 - Erase flash programming words
aidangarske
committed
696be66
F-14121 - Erase flash read-back buffers
aidangarske
committed
1faaa9d
F-14117 - Pad unaligned firmware update writes
aidangarske
committed
03806c6
F-14107 - Preserve FWU state when disarm fails
aidangarske
committed
02eaf74
F-14099 - Erase vault request and plaintext buffers
aidangarske
committed
7971342
F-14100 - Erase storage request and plaintext buffers
aidangarske
committed
e11d10f
F-14106 - Preserve sealed removal and reject key deletion
aidangarske
committed
f752dfb
F-14106 - Cover sealed deletion recovery
aidangarske
committed
1303542
F-14111 - Cover queued mutex handoff
aidangarske
committed
316d252
F-14123 - Preserve HSM fault canary
aidangarske
committed
849197b
F-14117 - Cover padded FWU writes
aidangarske
committed
97b8895
F-14107 - Cover failed FWU disarm
aidangarske
committed
7effa55
F-14127 - Keep guest RAM clearing word-efficient
aidangarske
committed
be6183b
F-14100 - Keep full buffer clearing responsive
aidangarske
committed
fd179ea
F-14109 - Reset and latch guest SysTick safely
aidangarske
committed
2226982
F-14118 - Preserve relay flow while clearing packets
aidangarske
committed
143023a
F-14111 - Correct lock-wait diagnostic comment
aidangarske
committed
6de4635
F-14123 - Keep HSM tasklet faults contained
aidangarske
committed
d8b5d76
F-14106 - Preserve keys during sealed delete recovery
aidangarske
committed
cb90aa4
Reject key deletion through vault storage remove
aidangarske
committed
9d30f4e
Wipe a faulted wolfHSM tasklet stack through the SPM-private stack module
aidangarske
committed
3faf8f4