stm32h5-tz-wolfhsm: align NSC veneer pointer checks to CMSE_NONSECURE

Author: aidangarske

src/wolfhsm_callable.c

@@ -138,13 +138,14 @@ int CSME_NSE_API wcs_wolfhsm_transmit(const uint8_t *cmd, uint32_t cmdSz,
     /* The caller is the non-secure world. Validate every caller-supplied
      * pointer references non-secure memory before dereferencing it, so a
      * compromised NS app cannot trick the secure side into reading or
-     * writing through a secure-world pointer. Check the SAU/IDAU security
-     * attribution only (CMSE_AU_NONSECURE); the NS MPU is not configured in
-     * this demo, so an MPU-based permission check would reject valid
-     * buffers. rspSz is checked first since it is dereferenced below to
-     * obtain the response capacity. */
+     * writing through a secure-world pointer. Use CMSE_NONSECURE to match the
+     * sibling veneers (fwtpm_callable.c, pkcs11_callable.c, wc_callable.c):
+     * the relevant property is the Secure/Non-secure attribution (SAU/IDAU);
+     * the MPU read/write bits read back as 0 when NO_MPU is set and do not
+     * constrain Secure accesses to NS memory anyway. rspSz is checked first
+     * since it is dereferenced below to obtain the response capacity. */
     if (cmse_check_address_range((void *)rspSz, sizeof(*rspSz),
-            CMSE_AU_NONSECURE) == NULL) {
+            CMSE_NONSECURE) == NULL) {
         return WH_ERROR_BADARGS;
     }
     /* single-fetch *rspSz so it cannot be re-read after validation */
@@ -159,12 +160,12 @@ int CSME_NSE_API wcs_wolfhsm_transmit(const uint8_t *cmd, uint32_t cmdSz,
         return WH_ERROR_BADARGS;
     }
     if (cmse_check_address_range((void *)cmd, cmdSz,
-            CMSE_AU_NONSECURE) == NULL) {
+            CMSE_NONSECURE) == NULL) {
         *rspSz = 0;
         return WH_ERROR_BADARGS;
     }
     if (cmse_check_address_range(rsp, rsp_capacity,
-            CMSE_AU_NONSECURE) == NULL) {
+            CMSE_NONSECURE) == NULL) {
         *rspSz = 0;
         return WH_ERROR_BADARGS;
     }