Update wolfHSM pin for STM32H5 flash support

[aidangarske]

• Update wolfHSM to the tested v1.5-based PR commit for STM32H5 16-byte flash programming, with the wolfTrust integration changes it requires.
• Update the wolfSSL pin and compatibility glue used by the same host and target builds.
• Keep auto-pin updates release-based; the workflow will not replace this newer PR pin with an older tag.

Dependency / before merge

• Depends on Support 128-bit flash programming units wolfHSM#524
• This PR temporarily pins wolfHSM commit 97dbbd72ad2bf757279d7dc5101580290525c647 from the #524 branch in aidangarske/wolfHSM.
• merge this after 524
• then replace reference to upstream master pin

[Copilot]

Copilot review overview

🟡 Changes recommended

The shared STM32H563 glue assigns client ID 1 to both HSM guests, while the auto-pin guard uses a non-upstream commit and can freeze dependency updates.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1 · 2

Open (3)

• Hard-coded client ID breaks guest namespace isolation · New
• Incorrect submodule commit gate rejects compatible releases · New
• Host tests omit coverage for the 16-byte time path · New

What changed in this PR

Updates wolfHSM/wolfSSL integration for STM32H5 16-byte flash programming and adjusts client initialization, secure build configuration, and dependency pinning.

Changes:

• Removes redundant crypto-callback registration and assigns client IDs.
• Adds 16-byte flash and freestanding build support.
• Improves attestation response validation and auto-pin safeguards.

File	Description
tests/​host/​wolfhsm_loopback/​test_loopback.c	Relies on wolfHSM client auto-registration.
tests/​host/​psa_ffm_client/​Makefile	Adds math source dependencies.
tests/​host/​ffm_veneer/​Makefile	Adds math source dependencies.
tests/​host/​attestation_iak/​main.c	Uses configured flash page size.
tests/​firmware/​zephyr-stm32h5/​scripts/​build_freertos_guest.sh	Sets guest client ID.
tests/​firmware/​zephyr-stm32h5/​module/​wolfhsm-client/​src/​wolfhsm_zephyr_init.c	Updates client initialization.
tests/​firmware/​zephyr-stm32h5/​module/​wolfhsm-client/​src/​wolfhsm_client_glue.c	Adds configurable client IDs.
tests/​firmware/​zephyr-stm32h5/​apps/​freertos_guest1/​main.c	Removes manual callback registration.
tests/​firmware/​stm32h563/​nonsecure/​wolfhsm_client_glue.c	Updates the guest client namespace.
src/​services/​wolfhsm/​wt_hsm.c	Validates key-generation response length.
src/​services/​wolfhsm/​runner/​wh_settings_local.h	Enables 16-byte flash units and disables logging.
src/​services/​wolfhsm/​runner/​user_settings.h	Adds freestanding wolfCrypt settings.
src/​services/​wolfhsm/​runner/​libc_stubs.h	Declares libc stubs.
mk/​common.mk	Adds wolfCrypt memory support.
.github/​workflows/​auto-pin-dependencies.yml	Preserves required dependency history.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 1

Open (1)

• This makes a transient Secure Partition restart failure terminal for the SYS_INIT path. The… · New

Resolved since last review (3)

• Hard-coded client ID breaks guest namespace isolation
• Host tests omit coverage for the 16-byte time path
• Incorrect submodule commit gate rejects compatible releases

[aidangarske]

Have to close since the repo went to public and merge base is invalid now