Add SPM-mediated PKCS#11 and TPM 2.0 interfaces

.github/workflows/README.md

@@ -24,9 +24,17 @@ An accepted upload queues analysis; results appear after Coverity processes it.
 | **Fast (per-PR)** | every PR; push to main | host unit suites, ISO C99, house style, bare-scope scan, Arm PSA-FF conformance, cross-compile, compiler matrix, sanitizers, valgrind, integrations, core/port split guard |
 | **M33MU smoke** | every PR | per port, on both crypto engines: STM32H563 `positive gtzcneg crossdomain bothpsa confboot devcrypto`; MIMXRT700 `positive ahbscneg crossdomain bothpsa confboot devcrypto` |
 | **M33MU full** | PR labels `ci:all`, `ci:stm32h563`, `ci:imxrt700`; push to main; `cron: 0 8 * * *`; `workflow_dispatch` (port input) | every scenario of that port on both engines (see below) |
-| **AArch64 smoke** | every PR | a representative subset: `virt-gicv3-a72` `smoke boot positive crossdomain ffa-direct confboot devcrypto` on both crypto engines, and `versal-virt` the same on the native engine |
+| **AArch64 smoke** | every PR | a representative subset: `virt-gicv3-a72` `smoke boot positive crossdomain ffa-direct confboot devcrypto` on both crypto engines, `versal-virt` the same on the native engine, plus dedicated QEMU fwTPM and PKCS#11 interface and isolation jobs |
 | **AArch64 full** | PR labels `ci:all`, `ci:aarch64`, `ci:qemu-virt`, `ci:qemu-versal`; push to main; nightly; `workflow_dispatch` (cell input) | every AArch64 scenario and the Arm FF-A ACS groups on three QEMU cells under both crypto engines (see below) |
 
+All dedicated API and interface-isolation rows require a real terminal pass
+marker; a successful skip cannot satisfy the job. PSA has one positive check
+per engine in the AArch64 API matrix.
+The TPM and PKCS#11 runtime scenarios run as eight dedicated PR checks on
+`virt`, with both `native` and `hsm` for each scenario: fwTPM, fwTPM isolation, PKCS#11, and PKCS#11 isolation. Versal
+cross-builds both configurations but its QEMU model cannot provide the
+XMPU/RISAF isolation those scenarios require.
+
 The M33MU workflow (`m33mu.yml`) is label-selected the way wolfProvider's
 `pr-osp-select.yml` is: a `select` job checks the routing table
 (`scenario_matrix.py --selftest`), reads the PR's `ci:*` labels, the
@@ -63,6 +71,10 @@ test-target` also reads. The table below is a representative slice:
 | `stm32h563_confboot_<engine>` | `confboot` | full Arm FF-M IPC suite |
 | `stm32h563_devstorage_<engine>` | `devstorage` | PSA ITS/PS conformance |
 | `stm32h563_devcrypto_<engine>` | `devcrypto` | PSA Crypto conformance |
+| `stm32h563_pkcs11_<zephyr\|freertos>_<engine>` | `pkcs11` | each RTOS application runs all 40 PKCS#11 cases through `SERVICE_PKCS11` and the isolated provider |
+| `stm32h563_tpm_<zephyr\|freertos>_<engine>` | `tpm` | each RTOS application sends real TPM 2.0 commands through `SERVICE_TPM` to the isolated fwTPM guest |
+| `stm32h563_pkcs11_isolation_<engine>` | `pkcs11neg` | PKCS#11 partition-band isolation and provider recovery |
+| `stm32h563_tpm2_isolation_<engine>` | `tpmneg` | TPM relay and fwTPM partition-band isolation |
 | `stm32h563_vaultrecover_<engine>` | `vaultrecover` | #95 foreign pool reformatted |
 | `stm32h563_vaultrecoversec_<engine>` | `vaultrecoversec` | #95 SECURED never wipes |
 | `mimxrt700_positive_<engine>` | `positive` | MIMXRT700 chain under the RT700 model, both guests finish |
@@ -114,6 +126,11 @@ full matrix. The cells and the smoke subset live in
 
 | Check name | What it proves |
 |------------|----------------|
+| `qemuvirt_psa_<engine>` | the Normal-world PSA client uses the selected engine through FF-A |
+| `qemuvirt_fwtpm_<engine>` | the Normal-world application sends real TPM 2.0 GetRandom, CreatePrimary, Sign, PCR Extend, and PCR Read commands through FF-A and `SERVICE_TPM` to the isolated fwTPM |
+| `qemuvirt_fwtpm_isolation_<engine>` | the fwTPM round trip plus TPM state-band, provider-RAM, and execute-never isolation negatives |
+| `qemuvirt_pkcs11_<engine>` | the Normal-world application runs all 40 PKCS#11 cases through FF-A and the isolated provider |
+| `qemuvirt_pkcs11_isolation_<engine>` | the PKCS#11 suite plus state-band, provider-RAM, execute-never, and engine-appropriate restart/recovery negatives |
 | `el3_<cell>_<engine>` | the EL3 image links under the symbol guard, then the tier's QEMU AArch64 scenarios run through `tests/target/run_suite.sh qemu-a` |
 | `ffa_acs_<cell>_<engine>` | the Arm FF-A ACS groups (discovery, direct and indirect messaging, memory, notifications, interrupts) at their asserted floors (full tier only) |
 

.github/workflows/aarch64-cross-compile.yml

@@ -50,6 +50,89 @@ jobs:
           for e in json.load(sys.stdin):
               print(e["job"], "(" + e["engine"] + ")")'
 
+  interfaces-qemu-a:
+    name: ${{ matrix.job }}
+    if: >-
+      github.event_name != 'workflow_dispatch' || inputs.cell == '' ||
+      inputs.cell == 'all' || inputs.cell == 'qemu-virt' ||
+      inputs.cell == 'virt-gicv3-a72'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    container:
+      image: ghcr.io/wolfssl/wolfboot-ci-aarch64:v1.15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - job: qemuvirt_psa_native
+            scenario: positive
+            engine: native
+          - job: qemuvirt_psa_hsm
+            scenario: positive
+            engine: hsm
+          - job: qemuvirt_fwtpm_hsm
+            scenario: tpm
+            engine: hsm
+          - job: qemuvirt_fwtpm_native
+            scenario: tpm
+            engine: native
+          - job: qemuvirt_fwtpm_isolation_hsm
+            scenario: tpmneg
+            engine: hsm
+          - job: qemuvirt_fwtpm_isolation_native
+            scenario: tpmneg
+            engine: native
+          - job: qemuvirt_pkcs11_native
+            scenario: pkcs11
+            engine: native
+          - job: qemuvirt_pkcs11_hsm
+            scenario: pkcs11
+            engine: hsm
+          - job: qemuvirt_pkcs11_isolation_native
+            scenario: pkcs11neg
+            engine: native
+          - job: qemuvirt_pkcs11_isolation_hsm
+            scenario: pkcs11neg
+            engine: hsm
+    env:
+      WT_ENGINE: ${{ matrix.engine }}
+      WT_REQUIRE_SCENARIO_PASS: 1
+      MACHINE: virt
+      GIC: 3
+      CPU: cortex-a72
+      SMP: 1
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Trust the checked-out workspace
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Initialize wolfTrust dependencies
+        run: |
+          git config --global url."https://github.com/".insteadOf "git@github.com:"
+          git submodule update --init --single-branch lib/wolfSSL lib/wolfHSM lib/wolfCOSE lib/wolfPSA lib/wolfTPM lib/wolfPKCS11
+
+      - name: Toolchain and emulator versions
+        run: |
+          aarch64-none-elf-gcc --version | head -1
+          qemu-system-aarch64 --version | head -1
+
+      - name: Self-test the EL3 symbol guard and the expect library
+        run: |
+          tools/check-el3-symbols.sh --selftest
+          tests/target/lib/expect.sh --selftest
+
+      - name: Run the direct SPM interface scenario
+        run: tests/target/run_suite.sh qemu-a ${{ matrix.scenario }}
+
+      - name: Show the boot logs
+        if: always()
+        run: |
+          for f in logs/target-*.log; do
+            echo "== $f"
+            cat "$f" || true
+          done
+
   qemu-a:
     name: ${{ matrix.job }}
     needs: select
@@ -78,7 +161,7 @@ jobs:
       - name: Initialize wolfTrust dependencies
         run: |
           git config --global url."https://github.com/".insteadOf "git@github.com:"
-          git submodule update --init --single-branch lib/wolfSSL lib/wolfHSM lib/wolfCOSE lib/wolfPSA
+          git submodule update --init --single-branch lib/wolfSSL lib/wolfHSM lib/wolfCOSE lib/wolfPSA lib/wolfTPM lib/wolfPKCS11
 
       - name: Toolchain and emulator versions
         run: |
@@ -95,6 +178,17 @@ jobs:
         if: matrix.kind == 'suite'
         run: make ARCH=aarch64 TARGET=${{ matrix.target }} WT_GIC_VERSION="$GIC" WT_CPU="$CPU" BUILD_DIR=build-aarch64-guard el3-image
 
+      - name: Cross-build the Versal TPM and PKCS11 interfaces
+        if: matrix.kind == 'suite' && matrix.target == 'versal'
+        run: |
+          make ARCH=aarch64 TARGET=versal WT_GIC_VERSION="$GIC" \
+            WT_CPU="$CPU" WT_PORT_BOOT_CPUS=1 WT_ENGINE=${{ matrix.engine }} CONFIG_TPM=y \
+            WT_ATTEST_COSE=0 BUILD_DIR=build-versal-tpm secure-image
+          make ARCH=aarch64 TARGET=versal WT_GIC_VERSION="$GIC" \
+            WT_CPU="$CPU" WT_PORT_BOOT_CPUS=1 CONFIG_PKCS11=y \
+            WT_ENGINE=${{ matrix.engine }} WT_ATTEST_COSE=0 \
+            BUILD_DIR=build-versal-pkcs11 secure-image
+
       - name: Fetch the pinned Arm FF-A ACS once for the six groups
         if: matrix.kind == 'acs'
         run: |

.github/workflows/cross-compile.yml

@@ -25,7 +25,9 @@ jobs:
           git config --global url."https://github.com/".insteadOf git@github.com:
           git submodule update --init --depth 1 --jobs 4 \
             lib/wolfCOSE lib/wolfHSM lib/wolfPSA lib/wolfSSL \
-            lib/wolfhal
+            lib/wolfTPM lib/wolfPKCS11 lib/wolfhal
+          test -f lib/wolfTPM/src/fwtpm/fwtpm.c
+          test -f lib/wolfPKCS11/src/wolfpkcs11.c
       - name: Build STM32H563 secure firmware
         run: make -C tests/firmware/stm32h563 all TOOLPREFIX=arm-none-eabi-
       - name: Validate the LTO gate, rebuild, and size reduction
@@ -96,3 +98,13 @@ jobs:
               WT_CONFORMANCE=1 secure-image TOOLPREFIX=arm-none-eabi- \
               BUILD_DIR=build_rt700_conf_$engine
           done
+      - name: Build both interfaces with both crypto engines on both ports
+        run: |
+          for engine in native hsm; do
+            for target in stm32h563 mimxrt700; do
+              make TARGET="$target" CONFIG_TPM=y WT_ENGINE="$engine" \
+                WT_ATTEST_COSE=0 BUILD_DIR="build-$target-tpm-$engine" secure-image
+              make TARGET="$target" CONFIG_PKCS11=y WT_ENGINE="$engine" \
+                WT_ATTEST_COSE=0 BUILD_DIR="build-$target-pkcs11-$engine" secure-image
+            done
+          done