port/stmicro/stm32-tz: review fixes for NSC transport

- _NscServerRecv clears ctx->rsp_size up-front so error paths leave
  no stale response state behind.
- _NscClientRecv rejects too-small caller buffers with WH_ERROR_BADARGS
  instead of WH_ERROR_ABORTED; cached response is preserved for retry.
- _NscClientSend returns WH_ERROR_NOTREADY if a prior response has not
  been consumed; propagates known WH_ERROR_* codes from the veneer.
- _NscServerCleanup zeroes the context so stale NS pointers cannot
  survive a reinit.
- _NscServerSend documents the per-call veneer staging contract.
- Reorder whTransportNscServerContext fields to satisfy -Wpadded.
- Document WOLFHSM_CFG_PORT_STM32_TZ_NSC in wh_settings.h.
- Cover the new behaviors in wh_test_transport_nsc and add the NSC
  contexts to the struct padding check.

Author: aidangarske

port/stmicro/stm32-tz/wh_transport_nsc.c

@@ -16,8 +16,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ * along with wolfHSM.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #include "wolfhsm/wh_settings.h"
@@ -79,12 +78,21 @@ static int _NscClientSend(void* context, uint16_t size, const void* data)
     if (size == 0U || size > WH_TRANSPORT_NSC_BUFFER_SIZE) {
         return WH_ERROR_BADARGS;
     }
+    /* prior response must be consumed before next Send */
+    if (ctx->last_rsp_size != 0U) {
+        return WH_ERROR_NOTREADY;
+    }
 
     rspSz = (uint32_t)WH_TRANSPORT_NSC_BUFFER_SIZE;
     rc    = wcs_wolfhsm_transmit((const uint8_t*)data, (uint32_t)size,
                                  ctx->rsp_buf, &rspSz);
     if (rc != 0) {
         ctx->last_rsp_size = 0;
+        /* propagate known wolfHSM error codes, collapse unknowns */
+        if (rc == WH_ERROR_BADARGS || rc == WH_ERROR_NOTREADY ||
+            rc == WH_ERROR_ABORTED) {
+            return rc;
+        }
         return WH_ERROR_ABORTED;
     }
     if (rspSz == 0U || rspSz > (uint32_t)WH_TRANSPORT_NSC_BUFFER_SIZE) {
@@ -107,6 +115,10 @@ static int _NscClientRecv(void* context, uint16_t* out_size, void* data)
     if (ctx->last_rsp_size == 0U) {
         return WH_ERROR_NOTREADY;
     }
+    /* out_size is in/out capacity; reject truncation, keep cached response */
+    if (*out_size < ctx->last_rsp_size) {
+        return WH_ERROR_BADARGS;
+    }
 
     memcpy(data, ctx->rsp_buf, ctx->last_rsp_size);
     *out_size          = ctx->last_rsp_size;
@@ -170,15 +182,14 @@ static int _NscServerRecv(void* context, uint16_t* inout_size, void* data)
     if (!ctx->request_pending || ctx->req_buf == NULL || ctx->req_size == 0U) {
         return WH_ERROR_NOTREADY;
     }
+    /* clear stale rsp_size up-front so every exit path leaves a clean state */
+    ctx->rsp_size = 0;
+
     if (ctx->req_size > *inout_size) {
         ctx->request_pending = 0;
         return WH_ERROR_ABORTED;
     }
 
-    /* Stale value from the previous call must not leak through error paths
-     * that skip Send. */
-    ctx->rsp_size = 0;
-
     memcpy(data, ctx->req_buf, ctx->req_size);
     *inout_size          = ctx->req_size;
     ctx->request_pending = 0;
@@ -187,6 +198,7 @@ static int _NscServerRecv(void* context, uint16_t* inout_size, void* data)
 
 static int _NscServerSend(void* context, uint16_t size, const void* data)
 {
+    /* veneer is responsible for Recv/Send pairing; Send does not enforce it */
     whTransportNscServerContext* ctx = (whTransportNscServerContext*)context;
 
     if (ctx == NULL || data == NULL) {
@@ -210,6 +222,8 @@ static int _NscServerCleanup(void* context)
     if (ctx == NULL) {
         return WH_ERROR_BADARGS;
     }
+    /* clear stale NS pointers so they cannot survive reinit */
+    memset(ctx, 0, sizeof(*ctx));
     return WH_ERROR_OK;
 }
 

port/stmicro/stm32-tz/wh_transport_nsc.h

@@ -16,8 +16,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ * along with wolfHSM.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -55,10 +54,10 @@ typedef struct {
     uint8_t  rsp_buf[WH_TRANSPORT_NSC_BUFFER_SIZE];
     uint16_t last_rsp_size;
     uint8_t  initialized;
-    uint8_t  WH_PAD[5]; /* Pad to 8-byte alignment */
+    uint8_t  WH_PAD[5]; /* trailing slack */
 } whTransportNscClientContext;
 
-/* Empty config struct - kept for ABI symmetry with other transports */
+/* Empty config; Init accepts NULL since there is nothing to read. */
 typedef struct {
     uint8_t WH_PAD[1];
 } whTransportNscClientConfig;
@@ -71,8 +70,8 @@ typedef struct {
  */
 typedef struct {
     const uint8_t* req_buf;
-    uint16_t       req_size;
     uint8_t*       rsp_buf;
+    uint16_t       req_size;
     uint16_t       rsp_capacity;
     uint16_t       rsp_size;        /* set by Send, read by veneer */
     uint8_t        request_pending; /* set by veneer, cleared by Recv */
@@ -83,6 +82,7 @@ typedef struct {
     uint8_t WH_PAD[1];
 } whTransportNscServerConfig;
 
+/* Pre-populated tables; callbacks are file-local in wh_transport_nsc.c */
 extern const whTransportClientCb whTransportNscClient_Cb;
 extern const whTransportServerCb whTransportNscServer_Cb;
 

test/wh_test_check_struct_padding.c

@@ -203,4 +203,10 @@ whMessageCert_VerifyAcertRequest whMessageCert_VerifyAcertRequest_test;
 #endif /* WOLFHSM_CFG_CERTIFICATE_MANAGER_ACERT */
 #endif /* WOLFHSM_CFG_CERTIFICATE_MANAGER */
 
+#ifdef WOLFHSM_CFG_PORT_STM32_TZ_NSC
+#include "wh_transport_nsc.h"
+whTransportNscClientContext whTransportNscClientContext_test;
+whTransportNscServerContext whTransportNscServerContext_test;
+#endif /* WOLFHSM_CFG_PORT_STM32_TZ_NSC */
+
 #endif /* WH_TEST_CHECK_STRUCT_PADDING_C_ */

test/wh_test_transport_nsc.c

@@ -100,11 +100,34 @@ static int test_client_callbacks(void)
     WH_TEST_ASSERT_RETURN(WH_ERROR_NOTREADY ==
         whTransportNscClient_Cb.Recv(&ctx, &sz, data_out));
 
+    /* too-small buffer returns BADARGS, cached response preserved */
+    rc = whTransportNscClient_Cb.Send(&ctx, sizeof(data_in), data_in);
+    WH_TEST_ASSERT_RETURN(rc == WH_ERROR_OK);
+    sz = (uint16_t)(sizeof(data_in));
+    WH_TEST_ASSERT_RETURN(WH_ERROR_BADARGS ==
+        whTransportNscClient_Cb.Recv(&ctx, &sz, data_out));
+    /* second Send before Recv consumes prior reply is NOTREADY */
+    WH_TEST_ASSERT_RETURN(WH_ERROR_NOTREADY ==
+        whTransportNscClient_Cb.Send(&ctx, sizeof(data_in), data_in));
+    sz = sizeof(data_out);
+    rc = whTransportNscClient_Cb.Recv(&ctx, &sz, data_out);
+    WH_TEST_ASSERT_RETURN(rc == WH_ERROR_OK);
+    WH_TEST_ASSERT_RETURN(sz == sizeof(data_in) + 1U);
+
     g_stub_force_rc = -42;
     rc = whTransportNscClient_Cb.Send(&ctx, sizeof(data_in), data_in);
     WH_TEST_ASSERT_RETURN(rc == WH_ERROR_ABORTED);
     g_stub_force_rc = 0;
 
+    /* WH_ERROR_* return values from the veneer are propagated unchanged. */
+    g_stub_force_rc = WH_ERROR_BADARGS;
+    rc = whTransportNscClient_Cb.Send(&ctx, sizeof(data_in), data_in);
+    WH_TEST_ASSERT_RETURN(rc == WH_ERROR_BADARGS);
+    g_stub_force_rc = WH_ERROR_NOTREADY;
+    rc = whTransportNscClient_Cb.Send(&ctx, sizeof(data_in), data_in);
+    WH_TEST_ASSERT_RETURN(rc == WH_ERROR_NOTREADY);
+    g_stub_force_rc = 0;
+
     g_stub_force_rspSz = (uint32_t)WH_TRANSPORT_NSC_BUFFER_SIZE + 1U;
     rc                 = whTransportNscClient_Cb.Send(&ctx, sizeof(data_in),
                                                       data_in);
@@ -157,11 +180,12 @@ static int test_server_callbacks(void)
     ctx.rsp_size        = 0xBEEF;
     ctx.request_pending = 1;
 
-    /* Oversize: must clear request_pending. */
+    /* oversize must clear request_pending and rsp_size */
     sz = (uint16_t)(sizeof(req) - 1U);
     rc = whTransportNscServer_Cb.Recv(&ctx, &sz, data_buf);
     WH_TEST_ASSERT_RETURN(rc == WH_ERROR_ABORTED);
     WH_TEST_ASSERT_RETURN(ctx.request_pending == 0U);
+    WH_TEST_ASSERT_RETURN(ctx.rsp_size == 0U);
 
     ctx.req_buf         = req;
     ctx.req_size        = (uint16_t)sizeof(req);

wolfhsm/wh_settings.h

@@ -129,6 +129,14 @@
  *  WOLFHSM_CFG_PORT_GETTIME - Function-like macro returning the current system
  *      time in microseconds as a uint64_t. Must be defined in wolfhsm_cfg.h for
  *      the active port UNLESS WOLFHSM_CFG_NO_SYS_TIME is defined
+ *
+ *  WOLFHSM_CFG_PORT_STM32_TZ_NSC - If defined, build the STM32 TrustZone
+ *      non-secure-callable (NSC) bridge transport in
+ *      port/stmicro/stm32-tz/wh_transport_nsc.{c,h}. Intended for ARMv8-M
+ *      Cortex-M deployments where a non-secure wolfHSM client calls into a
+ *      secure-side server through a single cmse_nonsecure_entry veneer
+ *      (e.g. wolfBoot's WOLFCRYPT_TZ_WOLFHSM engine).
+ *      Default: Not defined
 
  *  Overridable porting functions:
  *