Nations concerns, pr review fixes

  - Upgraded NS350 firmware from 0.1.0.15 to 0.1.0.16 which adds TPM_CMD support under PSK mode (previously returned Vd_InvalidCode)
  - PSK mode: GET_CAPABILITIES and NEGOTIATE_ALGORITHMS are not mandatory, can go directly from GET_VERSION to PSK_EXCHANGE (noted for future optimization)
  - Identity key mode: END_SESSION is mandatory (noted for future addition to test sequence)
  - All 17/17 hardware tests pass on new firmware
  - Fixed SPDM cleartext fallback in TPM2_SendCommand(): positive error codes from SPDM now return immediately instead of falling through to cleartext
  retry
  - Fixed same SPDM cleartext fallback in TPM2_SendCommandAuth(): same pattern applied
  - Added VdCode validation in wolfTPM2_SPDM_SecuredExchange(): verifies response matches expected TPM2_CMD vendor code before accepting payload
  - Enabled auto-connect for Nations: changed guard from WOLFSPDM_NUVOTON to WOLFTPM_SPDM_TCG and replaced wolfTPM2_SpdmConnectNuvoton() with generic
  wolfTPM2_SpdmConnect() so auto-SPDM works for both vendors
  - Added VdCode validation in wolfSPDM_TCG_VendorCmdClear(): verifies response vendor code matches expected value after parsing

Author: aidangarske

src/spdm/spdm_tcg.c

@@ -73,6 +73,10 @@ int wolfSPDM_TCG_VendorCmdClear(WOLFSPDM_CTX* ctx, const char* vdCode,
         if (rc < 0) {
             return rc;
         }
+        /* Verify response vendor code matches expected */
+        if (XMEMCMP(rsp->vdCode, vdCode, WOLFSPDM_VDCODE_LEN) != 0) {
+            return WOLFSPDM_E_PEER_ERROR;
+        }
     }
 
     return WOLFSPDM_SUCCESS;

src/tpm2_wrap.c

@@ -276,7 +276,7 @@ int wolfTPM2_Init(WOLFTPM2_DEV* dev, TPM2HalIoCb ioCb, void* userCtx)
     XMEMSET(dev->session, 0, sizeof(dev->session));
     wolfTPM2_SetAuthPassword(dev, 0, NULL);
 
-#if defined(WOLFTPM_SPDM) && defined(WOLFSPDM_NUVOTON)
+#if defined(WOLFTPM_SPDM) && defined(WOLFTPM_SPDM_TCG)
     /* If TPM is in SPDM-only mode, transparently establish an SPDM session
      * so all subsequent TPM commands are encrypted over the bus.
      * This allows existing binaries (caps, wrap_test, unit.test) to work
@@ -292,7 +292,7 @@ int wolfTPM2_Init(WOLFTPM2_DEV* dev, TPM2HalIoCb ioCb, void* userCtx)
             return rc;
         }
 
-        rc = wolfTPM2_SpdmConnectNuvoton(dev, NULL, 0, NULL, 0);
+        rc = wolfTPM2_SpdmConnect(dev);
         if (rc != 0) {
         #ifdef DEBUG_WOLFTPM
             printf("SPDM auto-connect failed: %d\n", rc);