Harden wolfTrust service isolation and recovery by aidangarske · Pull Request #22 · wolfSSL/wolfTrust

aidangarske · 2026-09-23T00:24:42Z

F-14097, F-14098, F-14096, F-14111, F-14114, F-14104, F-14112, F-14118, 
F-14124, F-14125, F-14119, F-14122, F-14123, F-14095, F-14109, F-14126, 
F-14127, F-14108, F-14101, F-14102, F-14120, F-14121, F-14117, F-14107, 
F-14099, F-14100, F-14106

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 2 · 1

Open (3)

The byte-wise clearing loop fixes correctness for non-4-byte sizes, but it can be significantly… · New
wt_hsm_relay_submit now unconditionally dereferences resp_len before any validation. If… · New
wt_forceZero introduces a mixed-case public API name in a codebase that otherwise predominantly… · New

What changed in this PR

This PR addresses low/info Fenrir findings by tightening failure paths, improving fault handling, and clearing sensitive buffers across FWU/vault/HSM relay paths, along with related documentation updates.

Changes:

Add explicit zeroization of sensitive request/response/staging buffers in multiple services and transports.
Harden scheduler/SPM/coroutine/IRQ/SysTick paths and guest restart/quarantine cleanup behavior.
Update vault sealed-object deletion/recovery logic and align FWU write behavior with padded final blocks.

File	Description
tests/firmware/zephyr-stm32h5/apps/guest0_psa/src/main.c	Updates test documentation/comments for PS/FWU service behavior.
src/sync/mutex.c	Prevents double-enqueue by detecting if a coroutine is already waiting on a mutex.
src/spm_partitions.c	Clarifies PS partition behavior and trust boundaries in comments.
src/spm_gate.c	Forces panic on unexpected gate outcomes in one path.
src/services/wolfhsm/wt_hsm_vault.c	Adds sealed deletion marker + recovery and tightens remove semantics.
src/services/wolfhsm/wt_hsm_seal.c	Updates trust-boundary documentation for seal key caching.
src/services/wolfhsm/wt_hsm.c	Adds zeroization of relay buffers/server/crypto state on cleanup, reinit, and fault.
src/services/wolfhsm/runner/secure.ld	Updates memory-region comments to reflect confined/unprivileged SPs.
src/services/vnet/vnet_relay_service.c	Corrects RX_FETCH behavior description.
src/services/vault_service.c	Restructures dispatch to avoid early returns and zeroizes buffers before return.
src/services/storage_service.c	Restructures dispatch similarly and clears request buffer before return.
src/services/hsm_relay_service.c	Returns unified status + zeroizes relay I/O buffer before return.
src/services/fwu_service.c	Pads unaligned final block to backend alignment; tightens reset/install failure behavior.
src/sched/coroutine.c	Adds canary checks around context switches and null-safety.
src/monitor.c	Clears restart window earlier and fails connections on quarantine.
src/ffm_boot.c	Updates caller-validation comment to match new pointer validation model.
src/client/psa_storage_client.c	Zeroizes client-side request buffer after use.
src/client/hsm_psa_transport.c	Ensures response buffer is cleared on init/cleanup/send/recv error paths.
src/arch/common/spm_gate_core.c	Tracks lock waits explicitly; avoids waking non-blocked coroutines; runs RUNNABLE SPs.
src/arch/armv8m/sp_fault_armv8m.c	Updates fault-recovery comment to match new behavior.
src/arch/armv8m/irq_armv8m.c	Uses NS PPB alias for guest IRQ mask ops; simplifies secure IRQ enable/disable.
src/arch/armv8m/guest_context_armv8m.c	Fixes SysTick restore sequencing; fixes guest memory zeroing for non-word sizes.
port/stm32h563/platform_stm32h563.c	Updates MPU whitelist comment for NS RAM usage.
port/stm32h563/memory_map.h	Updates vault/FWU stack comments reflecting confined SP model.
port/stm32h563/hsm_flash.c	Zeroizes temporary flash buffers; improves verify/blank-check error flow.
include/wolftrust/zeroize.h	Introduces a force-zero helper for sensitive data clearing.
include/wolftrust/spm_sched.h	Updates service-start documentation to match confined/unprivileged SP model.
include/wolftrust/services/vnet_relay.h	Updates RX_FETCH token semantics documentation.
include/wolftrust/services/vault_service.h	Updates vault/key/RNG trust-boundary documentation.
include/wolftrust/services/storage_service.h	Updates sealing trust-boundary documentation.
include/wolftrust/services/hsm.h	Updates fault notification/sealer/RNG documentation and semantics.
docs/TF-M-Compatibility.md	Updates FWU compatibility notes to reflect padding behavior.
docs/Services.md	Updates FWU service description to reflect padding + offset alignment.
docs/API-Reference.md	Updates FWU API reference to reflect padding + component-id deviation.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

 void wt_arch_zero_guest_memory(uintptr_t base, size_t size)
 {
-    volatile uint32_t* ptr = (volatile uint32_t*)base;
-    size_t words = size / sizeof(uint32_t);
+    volatile uint8_t* ptr = (volatile uint8_t*)base;
    size_t i;

-    for (i = 0; i < words; ++i) {
+    for (i = 0U; i < size; ++i) {
        ptr[i] = 0u;
    }


+    *resp_len = 0U;
    if (!g->ready || g->transport_ctx != buf) {
        return WH_ERROR_NOTREADY;
    }


+
+#include <stddef.h>
+
+static inline void wt_forceZero(void* memory, size_t size)


wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #22

Scan targets checked: wolftrust-src, wolftrust-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

wolfSSL-Fenrir-bot · 2026-09-23T00:45:29Z

+                      sizeof(g_relay_bufs[guest_id]));
+    wt_hsm_force_zero(&g->server, sizeof(g->server));
+    wt_hsm_force_zero(&g->crypto, sizeof(g->crypto));
+    wt_hsm_force_zero(&g_co_stack_slots[guest_id],


Erasing the tasklet stack on fault destroys its canary and panics the whole system · Fault containment failure

wt_hsm_signal_fault zeroes all of g_co_stack_slots[guest_id], including the WT_CO_STACK_CANARY word at co->stack_base. The fault handler then EXC_RETURNs into do_switch right after wt_co_arch_enter(to), where the newly added check_canary(to) reads 0 and calls wt_platform_panic(), so every contained HSM tasklet fault becomes a system-wide panic instead of a per-guest quarantine.

Suggested fix: Restore the canary word at stack[0] after erasing, or exclude the first sizeof(uint32_t) bytes of stack from the erase.

Related known findings (similar but distinct; listed for context, not part of this finding)

F-14123: F-14123 is the omission of zeroization in wt_hsm_signal_fault; this is a control-flow regression created by the zeroization as written, and clearing the state without clobbering the canary fixes this without reintroducing F-14123.

aidangarske added 27 commits September 22, 2026 15:31

F-14097 - Correct boot pointer-validation comment

4a3f9f0

F-14098 - Clarify VNET RX token exposure

2ad72b0

F-14096 - Correct secure partition privilege comments

2183259

F-14111 - Make queued mutex acquisition idempotent

cd95ff8

F-14114 - Check active coroutine stack canaries

f6fbbac

F-14104 - Panic on invalid wait output pointers

99af9ab

F-14112 - Dispatch runnable lock waiters

e4ad972

F-14118 - Erase shared HSM relay buffers

6a5e485

F-14124 - Erase HSM client response buffers

6c85f87

F-14125 - Erase storage client request copies

cd2f367

F-14119 - Erase per-guest HSM relay buffers

da41799

F-14122 - Erase HSM state during relay recovery

986ff51

F-14123 - Erase HSM tasklet state on fault

6a1f083

F-14095 - Correct HSM fault notification comments

c0901f9

F-14109 - Restore residual virtual SysTick period

8e4b5ab

F-14126 - Scrub restart-clear RAM before quarantine

e25079b

F-14127 - Erase non-word-aligned guest RAM tails

0428c38

F-14108 - Release IPC resources on quarantine

61dd392

F-14101 - Address the Non-secure NVIC banks

b03ac65

F-14102 - Support the full Secure IRQ range

af64aae

F-14120 - Erase flash programming words

ad5ebac

F-14121 - Erase flash read-back buffers

b5e2219

F-14117 - Pad unaligned firmware update writes

7397831

F-14107 - Preserve FWU state when disarm fails

fda8cbd

F-14099 - Erase vault request and plaintext buffers

68447af

F-14100 - Erase storage request and plaintext buffers

2e99843

F-14106 - Preserve sealed removal and reject key deletion

12cabaf

Copilot AI lite review requested due to automatic review settings September 23, 2026 00:24

aidangarske changed the title ~~Address Low and Info Fenrir findings~~ Harden wolfTrust service isolation and recovery Sep 23, 2026

aidangarske requested a review from wolfSSL-Fenrir-bot September 23, 2026 00:33

aidangarske self-assigned this Sep 23, 2026

Copilot AI reviewed Sep 23, 2026

View reviewed changes

wolfSSL-Fenrir-bot requested changes Sep 23, 2026

View reviewed changes

Copilot started reviewing on behalf of aidangarske September 23, 2026 02:38 View session

Navigation Menu

Harden wolfTrust service isolation and recovery - #22

Harden wolfTrust service isolation and recovery#22
aidangarske wants to merge 27 commits into
wolfSSL:mainfrom
aidangarske:fenrir-fixes-14095-14127

aidangarske commented Sep 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

wolfSSL-Fenrir-bot left a comment

Uh oh!

wolfSSL-Fenrir-bot Sep 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		#include <stddef.h>

		static inline void wt_forceZero(void* memory, size_t size)

Conversation

aidangarske commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #22

Uh oh!

wolfSSL-Fenrir-bot Sep 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aidangarske commented Sep 23, 2026 •

edited

Loading