[dgarske]

Description

The fwTPM as an OP-TEE trusted application: TPM 2.0 command processing in the secure world, client in the normal world. Needs only the TEE Internal Core API and OP-TEE secure storage, so nothing in it is specific to an SoC.

Builds on two wolfSSL changes: wolfSSL/wolfssl#11919 added the WOLFSSL_OPTEE build environment, and wolfSSL/wolfssl#11927 maps the wolfCrypt heap, RNG and time onto the TEE. That is why this port carries no platform shims of its own.

FWTPM_ProcessCommand has the shape of TA_InvokeCommandEntryPoint, so one invocation carries one whole TPM command and no IO HAL or TIS layer is involved. Both server loops block, which a trusted application cannot do, so fwtpm_io.c, fwtpm_tis.c, fwtpm_tis_shm.c and fwtpm_main.c are left out of a TA build.

Adds

• src/fwtpm/ports/optee/ - the TA_*EntryPoint functions and an NV journal on OP-TEE secure storage, keyed from the hardware unique key through the system PTA
• wolftpm/fwtpm/fwtpm_optee.h - the trusted application's UUID and the command IDs the client shares
• src/tpm2_optee.c, wolftpm/tpm2_optee.h - the WOLFTPM_OPTEE libteec client transport, following the WOLFTPM_SWTPM whole-command pattern rather than emulating TIS registers
• --enable-optee, with the src/include.am and CMake entries

Touches shared code

• src/tpm2.c, hal/tpm_io.c, hal/tpm_io.h, wolftpm/tpm2_types.h, src/tpm2_wrap.c, src/tpm2_spdm.c - add WOLFTPM_OPTEE to the existing "no bus, so no TIS" gates beside WOLFTPM_LINUX_DEV and WOLFTPM_SWTPM
• wolftpm/tpm2_types.h - a WOLFSSL_OPTEE arm for XTPM_GET_TIMEMS on TEE_GetSystemTime. A trusted application has no CLOCK_MONOTONIC, so the POSIX branch left WOLFTPM_HAVE_MONOTONIC_MS unset and command timeouts fell back to a counter. Not TEE_GetREETime, because the normal world owns that clock and can move it backwards. Applies with or without wolfCrypt
• wolftpm/tpm2_types.h - and where wolfCrypt is not compiled in, map that path's own XMALLOC and XFREE onto TEE_Malloc and TEE_Free. WOLFTPM2_NO_HEAP still wins and leaves both undefined
• src/fwtpm/fwtpm_nv.c - print the NV version mismatch with printf under WOLFSSL_OPTEE only, since a trusted application cannot link fprintf. Every other build keeps stderr
• src/fwtpm/ports/optee/fwtpm_optee_ta.c - accept TEE_PARAM_TYPE_MEMREF_INOUT for the response buffer as well as MEMREF_OUTPUT. Linux's tpm_ftpm_tee carries both memrefs in one registered shared memory and so passes the response as INOUT; without this it gets TEE_ERROR_NOT_SUPPORTED. Nothing is read out of that buffer either way, and it is what lets an in-kernel TPM driver bind to this trusted application and present a /dev/tpm device

Testing

Validated on an NVIDIA Jetson Orin Nano (L4T R36.4.4): unmodified caps, getrandom, native_test, wrap_test and the four pqc/ examples pass against the trusted application, and NV persists across separate client processes.

Multi-config build sweep green with WOLFTPM_OPTEE undefined, including the --enable-st33 and --enable-advio TIS paths the gate changes affect, --disable-wrapper, --enable-devtpm, --enable-autodetect and --enable-fwtpm --enable-v185. make check green against both the fwTPM server and ibmswtpm2.