Nvm ids per client

.github/workflows/build-and-test-clientonly.yml

@@ -49,14 +49,18 @@ jobs:
         config-hash: ${{ matrix.transport }}
         read-only: ${{ github.event_name == 'pull_request' }}
 
-    # Build example server
+    # Build example server. The SHE client tests use the test-only
+    # preprogram/destroy key-management messages, so the CI server must be
+    # built with WOLFHSM_CFG_SHE_ENABLE_TEST_KEY_MGMT (never enable this in
+    # production builds).
     - name: Build POSIX server
       run: |
         cd examples/posix/wh_posix_server
+        SHE_TEST_CFLAGS="-Wextra -DWOLFHSM_CFG_SHE_ENABLE_TEST_KEY_MGMT"
         if [ "${{ matrix.transport }}" = "tcp" ]; then
-            make -j SHE=1 WOLFSSL_DIR=../../../wolfssl
+            make -j SHE=1 WOLFSSL_DIR=../../../wolfssl CFLAGS_EXTRA="$SHE_TEST_CFLAGS"
         else
-            make -j TLS=1 SHE=1 WOLFSSL_DIR=../../../wolfssl
+            make -j TLS=1 SHE=1 WOLFSSL_DIR=../../../wolfssl CFLAGS_EXTRA="$SHE_TEST_CFLAGS"
         fi
 
     # Start the server in the background
@@ -123,16 +127,18 @@ jobs:
             make -j CLIENT_ONLY=1 TLS=1 SHE=1 AUTH=1 WOLFSSL_DIR=../wolfssl && make run
         fi
 
-    # Rebuild the server with AUTH support and restart
+    # Rebuild the server with AUTH support and restart. Keep the SHE test
+    # key-management define so the SHE client tests still work.
     - name: Rebuild and restart POSIX server for AUTH
       run: |
         kill $SERVER_PID || true
         cd examples/posix/wh_posix_server
         make clean
+        SHE_TEST_CFLAGS="-Wextra -DWOLFHSM_CFG_SHE_ENABLE_TEST_KEY_MGMT"
         if [ "${{ matrix.transport }}" = "tcp" ]; then
-            make -j SHE=1 AUTH=1 WOLFSSL_DIR=../../../wolfssl
+            make -j SHE=1 AUTH=1 WOLFSSL_DIR=../../../wolfssl CFLAGS_EXTRA="$SHE_TEST_CFLAGS"
         else
-            make -j TLS=1 SHE=1 AUTH=1 WOLFSSL_DIR=../../../wolfssl
+            make -j TLS=1 SHE=1 AUTH=1 WOLFSSL_DIR=../../../wolfssl CFLAGS_EXTRA="$SHE_TEST_CFLAGS"
         fi
         rm -f *.bin || true
         ./Build/wh_posix_server.elf --type ${{ matrix.transport }} &

.github/workflows/build-and-test-refactor.yml

@@ -140,6 +140,19 @@ jobs:
       if: matrix.group == 'wolfcrypt'
       run: cd test-refactor/posix && make clean && make -j SHE_GLOBAL=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
+    # Build and test with the global keys feature disabled (exercises the NVM
+    # id translation paths, including the DMA add path, with
+    # WOLFHSM_CFG_GLOBAL_KEYS undefined)
+    - name: Build and test refactor ASAN NOGLOBALKEYS DMA
+      if: matrix.group == 'wolfcrypt'
+      run: cd test-refactor/posix && make clean && make -j NOGLOBALKEYS=1 DMA=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
+
+    # Build and test with the legacy flat client NVM id space
+    # (WOLFHSM_CFG_LEGACY_CLIENT_NVM)
+    - name: Build and test refactor ASAN LEGACYNVM DMA
+      if: matrix.group == 'wolfcrypt'
+      run: cd test-refactor/posix && make clean && make -j LEGACYNVM=1 DMA=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
+
     # Build and test with DEBUG=1
     - name: Build and test refactor with DEBUG
       if: matrix.group == 'base'

.github/workflows/build-and-test-stress.yml

@@ -22,7 +22,9 @@ jobs:
 
     if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }}
     runs-on: ubuntu-latest
-    timeout-minutes: 10
+    # The stress suite runs every phase in three namespace variants
+    # (global/local/mixed), so give it headroom beyond the old 10 minutes
+    timeout-minutes: 20
 
     steps:
     - uses: actions/checkout@v4

.github/workflows/build-and-test.yml

@@ -128,6 +128,19 @@ jobs:
       if: matrix.group == 'wolfcrypt'
       run: cd test && make clean && make -j SHE_GLOBAL=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run
 
+    # Build and test with the global keys feature disabled (exercises the NVM
+    # id translation paths, including the DMA add path, with
+    # WOLFHSM_CFG_GLOBAL_KEYS undefined)
+    - name: Build and test ASAN NOGLOBALKEYS DMA
+      if: matrix.group == 'wolfcrypt'
+      run: cd test && make clean && make -j NOGLOBALKEYS=1 DMA=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run
+
+    # Build and test with the legacy flat client NVM id space
+    # (WOLFHSM_CFG_LEGACY_CLIENT_NVM)
+    - name: Build and test ASAN LEGACYNVM DMA
+      if: matrix.group == 'wolfcrypt'
+      run: cd test && make clean && make -j LEGACYNVM=1 DMA=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run
+
     # Build and test with per-client crypto affinity enabled (runs the crypto
     # affinity unit test, gated behind WOLFHSM_CFG_CRYPTO_AFFINITY)
     - name: Build and test CRYPTO_AFFINITY ASAN

docs/draft/auth.md

@@ -272,7 +272,7 @@ cfg.nvm = my_nvm_context;   /* whNvmContext* -> persistent; NULL -> RAM-only */
 
 Split object layout: sensitive credential material is deliberately kept out of the shared user index so that a single object read cannot leak PIN hashes or cert material.
 
-- User index: one object at `WH_NVM_ID_AUTH_USER_INDEX` holding the serialized `whAuthUser` records (identity and permissions, with `is_active` cleared). It carries no credential material. `method` and `credentials_len` are not stored here; they live in the per-user credential object metadata and are rebuilt at load. Marked `SENSITIVE | NONEXPORTABLE | NONMODIFIABLE` so clients cannot read, overwrite, or destroy it through the NVM message group. Written with the unchecked NVM add so the backend itself is not blocked by those policy flags.
+- User index: one object at `WH_NVM_ID_AUTH_USER_INDEX` holding the serialized `whAuthUser` records (identity and permissions, with `is_active` cleared). It carries no credential material. `method` and `credentials_len` are not stored here; they live in the per-user credential object metadata and are rebuilt at load. Marked `SENSITIVE | NONEXPORTABLE | NONMODIFIABLE` so clients cannot read, overwrite, or destroy it through the NVM message group. On default builds the reserved range is additionally outside the client NVM API's reachable id space entirely: client-supplied ids are translated into the per-client `WH_KEYTYPE_NVM` namespace, which cannot name these ids at all. Only with `WOLFHSM_CFG_LEGACY_CLIENT_NVM` (flat id space) do the policy flags become the sole protection. Written with the unchecked NVM add so the backend itself is not blocked by those policy flags.
 - Per-user credentials: each user's credential blob is its own object at `WH_NVM_ID_AUTH_CRED_BASE + (user_id - 1)`. These are read into a static, force-zeroed scratch buffer only for the duration of an authentication or credential change, never held resident.
 - The reserved id range therefore spans `WH_NVM_ID_AUTH_USER_INDEX` through `WH_NVM_ID_AUTH_CRED_BASE + (WH_AUTH_BASE_MAX_USERS - 1)`.
 

docs/src/3-Quickstart.md

@@ -244,7 +244,7 @@ Passing `INVALID_DEVID` makes the server perform crypto in software. To offload
 
 `whServerConfig` aggregates the three pieces configured above — the comm config (`.comm_config`), the initialized NVM context (`.nvm`), and the crypto context (`.crypto`) — into a single configuration. `wh_Server_Init()` wires them into the `whServerContext`, which from then on serves as the handle for all server operations.
 
-After initialization, the server must be told when the underlying transport is actually ready for communication by calling `wh_Server_SetConnected(server, WH_COMM_CONNECTED)`. Until the server is connected, `wh_Server_HandleRequestMessage()` returns `WH_ERROR_NOTREADY`. On the client side, the corresponding steps are simply `wh_Client_Init()` followed by `wh_Client_CommInit()`.
+After initialization, the server must be told when the underlying transport is actually ready for communication by calling `wh_Server_SetConnected(server, WH_COMM_CONNECTED)`. Until the server is connected, `wh_Server_HandleRequestMessage()` returns `WH_ERROR_NOTREADY`. On the client side, the corresponding steps are simply `wh_Client_Init()` followed by `wh_Client_CommInit()`. COMM INIT binds the client id that the server uses to namespace keys and objects, so the server refuses every other request until it has completed.
 
 ### Processing Requests