tests: subsys: secure_storage: Erase flash before write once test

tests/subsys/secure_storage/psa/its/Kconfig

@@ -0,0 +1,10 @@
+# Private config options for its test
+
+# Copyright (c) 2025 Analog Devices, Inc
+# SPDX-License-Identifier: Apache-2.0
+
+config TESTS_SECURE_STORAGE_PSA_ITS_ERASE_WITH_FLASH_WRITE
+	bool "Erase storage area with flash_write of erase values"
+	default y if ARCH_POSIX
+
+source "Kconfig.zephyr"

tests/subsys/secure_storage/psa/its/src/main.c

@@ -4,7 +4,79 @@
 #include <zephyr/ztest.h>
 #include <psa/internal_trusted_storage.h>
 
+#include <zephyr/types.h>
+#include <zephyr/storage/flash_map.h>
+#include <zephyr/drivers/flash.h>
+
 /* The flash must be erased after this test suite is run for the write-once entry test to pass. */
+
+#if !defined(CONFIG_BUILD_WITH_TFM) && defined(CONFIG_FLASH_PAGE_LAYOUT)
+
+#define FLASH_MEMSET_CLEAR_SIZE 512
+
+static const struct device *const fdev = DEVICE_DT_GET(DT_CHOSEN(zephyr_flash_controller));
+
+#define FLASH_ERASE_END_ADDR                                                                       \
+	(FIXED_PARTITION_OFFSET(storage_partition) + FIXED_PARTITION_SIZE(storage_partition))
+
+static int erase_flash(void)
+{
+	int rc;
+	off_t address = FIXED_PARTITION_OFFSET(storage_partition);
+	struct flash_pages_info page_info;
+	const struct flash_parameters *fparam = flash_get_parameters(fdev);
+	bool explicit_erase =
+		IS_BIT_SET(flash_params_get_erase_cap(fparam), FLASH_ERASE_C_EXPLICIT);
+
+	if (!explicit_erase &&
+	    !IS_ENABLED(CONFIG_TESTS_SECURE_STORAGE_PSA_ITS_ERASE_WITH_FLASH_WRITE)) {
+		return 0;
+	}
+
+	while (address < FLASH_ERASE_END_ADDR) {
+		rc = flash_get_page_info_by_offs(fdev, address, &page_info);
+		if (rc < 0) {
+			return rc;
+		}
+
+		if (explicit_erase) {
+			TC_PRINT("Erasing %zu at %lX\n", page_info.size, page_info.start_offset);
+			rc = flash_erase(fdev, page_info.start_offset, page_info.size);
+			if (rc < 0) {
+				return rc;
+			}
+		} else {
+			/* Lacking an explicit erase, just write all ones to the pages */
+			uint8_t clear_vals[FLASH_MEMSET_CLEAR_SIZE];
+			size_t to_clear = page_info.size;
+
+			memset(clear_vals, fparam->erase_value, FLASH_MEMSET_CLEAR_SIZE);
+
+			TC_PRINT("Setting %zX at %lX to 0x%02X\n", page_info.size,
+				 page_info.start_offset, fparam->erase_value);
+			while (to_clear > 0) {
+				rc = flash_write(
+					fdev, page_info.start_offset + page_info.size - to_clear,
+					clear_vals, MIN(FLASH_MEMSET_CLEAR_SIZE, to_clear));
+				if (rc < 0) {
+					return rc;
+				}
+
+				to_clear -= FLASH_MEMSET_CLEAR_SIZE;
+			}
+		}
+
+		address += page_info.size;
+	}
+
+	return 0;
+}
+
+/* Low priority to ensure we run after any flash drivers are initialized */
+SYS_INIT(erase_flash, POST_KERNEL, 100);
+
+#endif /* !defined(CONFIG_BUILD_WITH_TFM) && defined(CONFIG_FLASH_PAGE_LAYOUT) */
+
 ZTEST_SUITE(secure_storage_psa_its, NULL, NULL, NULL, NULL, NULL);
 
 #ifdef CONFIG_SECURE_STORAGE
@@ -119,8 +191,11 @@ ZTEST(secure_storage_psa_its, test_write_once_flag)
 	struct psa_storage_info_t info;
 
 	ret = psa_its_set(uid, sizeof(data), data, PSA_STORAGE_FLAG_WRITE_ONCE);
-	zassert_equal(ret, PSA_SUCCESS, "%s%d", (ret == PSA_ERROR_NOT_PERMITTED) ?
-		      "Has the flash been erased since this test ran? " : "", ret);
+	zassert_equal(ret, PSA_SUCCESS, "%s%d",
+		      (ret == PSA_ERROR_NOT_PERMITTED)
+			      ? "Has the flash been erased since this test ran? "
+			      : "",
+		      ret);
 
 	ret = psa_its_get_info(uid, &info);
 	zassert_equal(ret, PSA_SUCCESS);