Add stm32H5 TrustZone wolfHSM Port#348
Draft
aidangarske wants to merge 6 commits intowolfSSL:mainfrom
Draft
Conversation
New port/stmicro/stm32-tz/wh_transport_nsc.{c,h} implementing both
client and server callbacks for a synchronous TrustZone NSC bridge.
The non-secure (client) side calls a single cmse_nonsecure_entry
veneer (wcs_wolfhsm_transmit, provided by the host) which hands the
request to the secure-side server context, runs
wh_Server_HandleRequestMessage once inline, and returns the response
in the same call -- no polling, notify counter, or async
producer/consumer.
Send delivers; Recv returns the cached response. Server-side Recv
hands the request the host's NSC veneer parked in the static context;
Send writes the response back into the NS buffer and stores its size
for the veneer to read.
Used by wolfBoot's WOLFCRYPT_TZ_WOLFHSM=1 lane on STM32H5 (separate
PR against wolfBoot). Gated by WOLFHSM_CFG_PORT_STM32_TZ_NSC so the
file is safe to ship in the wolfHSM tree without forcing every
consumer to link the unresolved wcs_wolfhsm_transmit extern.
The field name is self-describing; the comment was duplicating it.
Add a port section describing the new port/stmicro/stm32-tz NSC bridge transport: synchronous single-call client Send/Recv, server-side static context, target-agnostic transport with the STM32H5 glue (NSC veneer, whFlashCb adapter, secure-side server init, NS test exerciser) living in the wolfBoot port.
Transport (port/stmicro/stm32-tz/wh_transport_nsc):
- _NscServerSend returns WH_ERROR_BADARGS for size validation
(only ABORTED when rsp_buf is NULL), matching the contract.
- _NscClientSend / _NscClientRecv reject calls on an
uninitialized context, giving ctx->initialized a purpose.
- _NscServerRecv clears request_pending on the oversize path
and resets rsp_size on entry to prevent stale-value leaks.
- Drop the redundant cmd_buf staging copy on the client side,
saving WH_COMM_MTU bytes of NS BSS plus a per-request memcpy.
Test:
- New test/wh_test_transport_nsc.c covering BADARGS, NOTREADY,
happy path, and the request_pending / rsp_size state machine
for both callback tables. Wired into whTest_Unit; new
STM32_TZ_NSC=1 build flag compiles the transport source.
Docs:
- chapter08: client Recv consumes the cached response on the
first call (subsequent calls return WH_ERROR_NOTREADY).
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds an STM32 TrustZone NSC bridge transport port (targeting ARMv8-M TrustZone use cases like STM32H5 + wolfBoot) along with unit tests, CI coverage, and documentation.
Changes:
- Introduces
port/stmicro/stm32-tz/wh_transport_nsc.{c,h}implementing synchronous NSC-based client/server transport callbacks. - Adds a host-side unit test (
wh_test_transport_nsc.c) plus a build flag (STM32_TZ_NSC=1) to compile/run it in the test harness. - Extends CI workflow and documentation to cover the new TrustZone NSC bridge transport.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
test/wh_test_transport_nsc.h |
Declares new NSC transport unit test entrypoint. |
test/wh_test_transport_nsc.c |
Adds unit tests + a stub veneer to validate client/server callback state machines. |
test/wh_test.c |
Registers the new unit test behind WOLFHSM_CFG_PORT_STM32_TZ_NSC. |
test/Makefile |
Adds STM32_TZ_NSC=1 build flag to compile the new port and tests. |
port/stmicro/stm32-tz/wh_transport_nsc.h |
Defines NSC client/server contexts, config stubs, and callback externs. |
port/stmicro/stm32-tz/wh_transport_nsc.c |
Implements synchronous NSC transport callbacks for client and server. |
docs/src/chapter08.md |
Documents the new STM32 TrustZone (STM32H5 / NSC bridge) port. |
.github/workflows/build-and-test.yml |
Adds CI lane to build/run tests with STM32_TZ_NSC=1 ASAN=1. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+99
to
+115
| static int _NscClientRecv(void* context, uint16_t* out_size, void* data) | ||
| { | ||
| whTransportNscClientContext* ctx = (whTransportNscClientContext*)context; | ||
|
|
||
| if (ctx == NULL || out_size == NULL || data == NULL || | ||
| ctx->initialized == 0U) { | ||
| return WH_ERROR_BADARGS; | ||
| } | ||
| if (ctx->last_rsp_size == 0U) { | ||
| return WH_ERROR_NOTREADY; | ||
| } | ||
|
|
||
| memcpy(data, ctx->rsp_buf, ctx->last_rsp_size); | ||
| *out_size = ctx->last_rsp_size; | ||
| ctx->last_rsp_size = 0; | ||
| return WH_ERROR_OK; | ||
| } |
| ctx->rsp_buf, &rspSz); | ||
| if (rc != 0) { | ||
| ctx->last_rsp_size = 0; | ||
| return WH_ERROR_ABORTED; |
| uint8_t rsp_buf[WH_TRANSPORT_NSC_BUFFER_SIZE]; | ||
| uint16_t last_rsp_size; | ||
| uint8_t initialized; | ||
| uint8_t WH_PAD[5]; /* Pad to 8-byte alignment */ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
port/stmicro/stm32-tz/wh_transport_nsc.{c,h}: a portablesynchronous TrustZone non-secure-callable bridge transport for
ARMv8-M Cortex-M targets. Client
Sendinvokes a host-suppliedveneer (
wcs_wolfhsm_transmit) inline and caches the response;client
Recvconsumes the cached response on the first call.Server-side callbacks consume the request the host's veneer parked
in a static context and write the response back into the non-secure
caller's buffer.
adapter, secure-side server init, NS test exerciser) lives in the
matching wolfBoot PR.
STM32_TZ_NSC=1build flag intest/Makefilecompiles thetransport into the host test build and pulls in a new unit test
test/wh_test_transport_nsc.ccovering BADARGS, NOTREADY, happy-path round trip, and the
request_pending/rsp_sizestatemachine for both callback tables.
.github/workflows/build-and-test.yml:STM32_TZ_NSC=1 ASAN=1build + run.docs/src/chapter08.md.Notes
WOLFCRYPT_TZ_WOLFHSM=1for STM32H5,which is the first consumer of this transport. here
Test plan
STM32_TZ_NSC=1 ASAN=1build +make run(CI)