Add 'unit-run' target, coverage via gcov. Fixed a bunch of fenrir reports.

.github/workflows/build-config-matrix.yml

@@ -39,8 +39,6 @@ jobs:
             modifiers: "-WOLFSSL_AES_CFB"
           - name: aes-ofb
             modifiers: "-WOLFSSL_AES_OFB"
-          - name: aes-ecb
-            modifiers: "-HAVE_AES_ECB"
           - name: des-ecb
             modifiers: "-WOLFSSL_DES_ECB"
           - name: cmac

.github/workflows/test-psa-api.yml

@@ -107,6 +107,9 @@ jobs:
           psa_ecc_ecdh_curve_test
           psa_xof_output_wrap_test
           psa_kdf_length_check_test
+          psa_kdf_expand_context_test
+          psa_kdf_repeat_step_test
+          psa_kdf_psk_to_ms_size_test
           psa_mldsa_det_sign_test
           psa_mldsa_any_hash_test
           psa_ecc_curve_caps_test
@@ -125,7 +128,13 @@ jobs:
           psa_pqc_export_seed_test
           psa_key_declared_bits_test
           psa_import_key_probe_test
+          psa_store_commit_test
+          psa_store_read_open_test
+          psa_store_dir_validation_test
           psa_devid_cryptocb_test
+          psa_kdf_zeroize_output_test
+          psa_import_zero_length_test
+          psa_copy_key_cross_lifetime_test
 
       - name: Run PSA API tests
         env:
@@ -155,6 +164,9 @@ jobs:
                    psa_ecc_ecdh_curve_test \
                    psa_xof_output_wrap_test \
                    psa_kdf_length_check_test \
+                   psa_kdf_expand_context_test \
+                   psa_kdf_repeat_step_test \
+                   psa_kdf_psk_to_ms_size_test \
                    psa_mldsa_det_sign_test \
                    psa_mldsa_any_hash_test \
                    psa_ecc_curve_caps_test \
@@ -173,7 +185,13 @@ jobs:
                    psa_pqc_export_seed_test \
                    psa_key_declared_bits_test \
                    psa_import_key_probe_test \
-                   psa_devid_cryptocb_test; do
+                   psa_store_commit_test \
+                   psa_store_read_open_test \
+                   psa_store_dir_validation_test \
+                   psa_devid_cryptocb_test \
+                   psa_kdf_zeroize_output_test \
+                   psa_import_zero_length_test \
+                   psa_copy_key_cross_lifetime_test; do
             echo "=== $t ==="
             rm -rf test/.store
             ./test/$t

.gitignore

@@ -1,4 +1,7 @@
 build
+# gcov coverage artifacts (make cov)
+*.gcda
+*.gcno
 src/.deps
 libwolfpsa.a
 test-psa-api/psa-arch-tests
@@ -67,3 +70,12 @@ test/psa_devid_cryptocb_test
 test/build-probe
 test/build-cryptocb
 test/build-cryptocb-asan
+test/psa_store_commit_test
+test/psa_store_dir_validation_test
+test/psa_store_read_open_test
+test/psa_kdf_expand_context_test
+test/psa_kdf_repeat_step_test
+test/psa_kdf_psk_to_ms_size_test
+test/psa_kdf_zeroize_output_test
+test/psa_import_zero_length_test
+test/psa_copy_key_cross_lifetime_test

Makefile

@@ -102,7 +102,18 @@ endif
 CFLAGS += $(DEBUG_FLAGS) $(SANITIZE_FLAGS)
 LDFLAGS += $(SANITIZE_FLAGS)
 
-.PHONY: all clean psa-objects
+# gcov coverage (make cov): instrument the library and the unit tests, run
+# the tests, and emit an HTML report of which lines of src/*.c they cover.
+# The unit tests link the instrumented shared library, so the runtime .gcda
+# files land next to the PIC objects in build/obj.pic.
+COV_DIR := build/coverage
+OPEN_CMD := $(shell command -v open >/dev/null 2>&1 && echo open || echo xdg-open)
+ifeq ($(COV),1)
+CFLAGS += --coverage
+LDFLAGS += --coverage
+endif
+
+.PHONY: all clean psa-objects unit-run run-tests cov covclean
 
 all: $(LIBNAME) $(SHLIBNAME)
 
@@ -135,6 +146,109 @@ $(OBJDIR_PIC)/wolfcrypt_%.o: $(WOLFSSL_PATH)/wolfcrypt/src/%.c
 	@mkdir -p $(OBJDIR_PIC)
 	$(CC) $(CPPFLAGS) $(DEPFLAGS) $(CFLAGS) -fPIC -c $< -o $@
 
+# The unit tests, in the order CI runs them (test-psa-api.yml). The servers
+# (psa_tls_client, psa_tls_server), the benchmark, and psa_crypto_init_test
+# (driven separately) are not unit tests and are not listed.
+UNIT_TESTS := psa_api_test \
+	psa_aead_multipart_test \
+	psa_copy_key_narrowing_test \
+	psa_ecc_bit_inference_test \
+	psa_des3_stack_scrub_test \
+	psa_ecc_curve_id_test \
+	psa_random_size_test \
+	psa_rsa_pss_interop_test \
+	psa_mldsa_test \
+	psa_mlkem_test \
+	psa_xof_test \
+	psa_key_wrap_test \
+	psa_sign_context_test \
+	psa_lms_xmss_verify_test \
+	psa_ascon_xchacha_test \
+	psa_sp800_108_test \
+	psa_14_misc_test \
+	psa_xof_input_wrap_test \
+	psa_pbkdf2_cmac_test \
+	psa_kdf_input_key_test \
+	psa_ecc_verify_curve_test \
+	psa_ecc_ecdh_curve_test \
+	psa_xof_output_wrap_test \
+	psa_kdf_length_check_test \
+	psa_kdf_expand_context_test \
+	psa_kdf_repeat_step_test \
+	psa_kdf_psk_to_ms_size_test \
+	psa_mldsa_det_sign_test \
+	psa_mldsa_any_hash_test \
+	psa_ecc_curve_caps_test \
+	psa_xof_no_backend_test \
+	psa_ecc_sig_len_test \
+	psa_xof_set_context_test \
+	psa_cipher_inplace_test \
+	psa_cipher_overlap_test \
+	psa_des3_pkcs7_test \
+	psa_eddsa_mont_export_test \
+	psa_eddsa_mont_gen_test \
+	psa_pure_eddsa_context_test \
+	psa_sign_hash_eddsa_test \
+	psa_key_infer_bits_test \
+	psa_cipher_oneshot_len_test \
+	psa_pqc_export_seed_test \
+	psa_key_declared_bits_test \
+	psa_import_key_probe_test \
+	psa_store_commit_test \
+	psa_store_read_open_test \
+	psa_store_dir_validation_test \
+	psa_devid_cryptocb_test \
+	psa_kdf_zeroize_output_test \
+	psa_import_zero_length_test \
+	psa_copy_key_cross_lifetime_test
+
+# Run the unit test loop from the repo root (psa_rsa_pss_interop_test reads
+# its certificate relative to the root). Assumes the tests are already built.
+run-tests:
+	@for t in $(UNIT_TESTS); do \
+	    echo "=== $$t ==="; \
+	    rm -rf test/.store; \
+	    ./test/$$t || exit 1; \
+	done
+
+# Build the library and the unit tests, then run every unit test.
+unit-run: all
+	@$(MAKE) -C test $(UNIT_TESTS)
+	@$(MAKE) run-tests
+
+# Build everything with gcov instrumentation, run the unit tests, and emit an
+# HTML coverage report for src/*.c (the bundled wolfCrypt sources are
+# excluded by the -f filter). The instrumented objects are dropped once the
+# report exists: a later non-coverage build would otherwise reuse them and
+# fail to link (undefined __gcov_init). The report itself is kept.
+cov:
+	@$(MAKE) clean
+	@$(MAKE) -C test clean
+	@$(MAKE) all COV=1
+	@$(MAKE) -C test $(UNIT_TESTS) COV=1
+	@$(MAKE) run-tests
+	@mkdir -p $(COV_DIR)
+	@echo "[COV] gcovr html"
+	@gcovr -r . -f '^src/.*\.c$$' \
+	    --gcov-ignore-errors=all \
+	    --html-medium-threshold 60 \
+	    --html-high-threshold 80 \
+	    --html-details -o $(COV_DIR)/index.html
+	@echo "[COV] report: $(COV_DIR)/index.html"
+	@echo "[COV] dropping instrumented objects"
+	@rm -rf $(OBJDIR) $(OBJDIR_PIC) $(LIBNAME) $(SHLIBNAME)
+	@$(MAKE) -C test clean
+	@if [ -n "$$DISPLAY" ] || [ -n "$$WAYLAND_DISPLAY" ]; then \
+	    $(OPEN_CMD) $(COV_DIR)/index.html || true; \
+	fi
+
+# Remove gcov artifacts and the coverage report.
+covclean:
+	rm -f $(OBJDIR)/*.gcda $(OBJDIR)/*.gcno \
+	      $(OBJDIR_PIC)/*.gcda $(OBJDIR_PIC)/*.gcno
+	rm -f test/psa_server/*.gcda test/psa_server/*.gcno
+	rm -rf $(COV_DIR)
+
 clean:
 	rm -rf $(BUILD_DIR) $(LIBNAME) $(SHLIBNAME)
 

build-test/user_settings.h

@@ -31,5 +31,14 @@
 #define SINGLE_THREADED
 #define WOLFSSL_PSA_ENGINE
 #define NO_DSA
+/* Constant-time AES backend (F-13878): the default software AES uses
+ * secret-indexed T-table loads, a cache-timing channel. WC_AES_BITSLICED is
+ * the portable consttime core; psa_aead.c fails the build if neither it nor
+ * WOLFSSL_AESNI is selected. */
+#define WC_AES_BITSLICED
+/* psa_sign_hash()/psa_verify_hash() must accept an all-zero digest (PSA
+ * treats the hash as opaque bytes); wolfCrypt rejects it by default, so opt
+ * out. psa_ecc.c #errors when HAVE_ECC is on and this is undefined. */
+#define WC_ALLOW_ECC_ZERO_HASH
 
 #endif /* WOLFSSL_USER_SETTINGS_H */

src/psa_aead.c

@@ -25,6 +25,21 @@
 
 #include <wolfssl/wolfcrypt/settings.h>
 
+/* The AEAD/CMAC/KDF paths process secret-derived AES keys. Require the
+ * constant-time software backend (WC_AES_BITSLICED): the default software
+ * fallback uses secret-indexed T-table loads (a cache-timing channel), and
+ * WOLFSSL_AESNI alone is not sufficient because wolfCrypt falls back to
+ * AesSetKey_C() (the same non-constant-time T-table path) when runtime
+ * AES-NI is unavailable. WC_AES_BITSLICED is the consttime fallback that
+ * covers both the no-AES-NI and the AES-NI-unavailable cases. Fail the build
+ * if it is not selected, but only when the PSA engine and an AES path are
+ * actually active: this file is otherwise inert (no PSA engine) or its AES
+ * code is excluded (NO_AES), and compiling this inactive source must not
+ * fail. */
+#if defined(WOLFSSL_PSA_ENGINE) && !defined(NO_AES) && !defined(WC_AES_BITSLICED)
+#error "wolfPSA needs the consttime AES backend (WC_AES_BITSLICED); WOLFSSL_AESNI alone leaves a non-constant-time runtime fallback"
+#endif
+
 #if defined(WOLFSSL_PSA_ENGINE)
 
 #include <psa/crypto.h>

src/psa_ecc.c

@@ -25,6 +25,23 @@
 
 #include <wolfssl/wolfcrypt/settings.h>
 
+/* psa_sign_hash()/psa_verify_hash() must accept an all-zero digest: PSA
+ * treats the hash argument as opaque bytes and ECDSA over e = 0 is
+ * well-defined. wolfCrypt rejects an all-zero digest by default (a guard
+ * against uninitialized buffers), which would surface as
+ * PSA_ERROR_INVALID_ARGUMENT for input the spec requires us to accept.
+ * WC_ALLOW_ECC_ZERO_HASH opts out of that rejection.
+ *
+ * The requirement is on the PSA ECDSA path itself, not on how the wolfCrypt
+ * config is supplied: any build that compiles the PSA ECC path (PSA engine +
+ * HAVE_ECC) must define WC_ALLOW_ECC_ZERO_HASH, whether the config comes from
+ * a WOLFSSL_SETTINGS_FILE, a WOLFSSL_USER_SETTINGS file, or the configure
+ * system. Builds without the PSA ECC path are unaffected. */
+#if defined(WOLFSSL_PSA_ENGINE) && defined(HAVE_ECC) \
+    && !defined(WC_ALLOW_ECC_ZERO_HASH)
+#error "wolfPSA needs WC_ALLOW_ECC_ZERO_HASH (psa_sign_hash/psa_verify_hash must accept an all-zero digest)"
+#endif
+
 #if defined(WOLFSSL_PSA_ENGINE) && defined(HAVE_ECC)
 
 #include <psa/crypto.h>