[dgarske]

Description

Board scaffolding for running the wolfTPM fwTPM as an OP-TEE trusted application on a Jetson Orin, driven from Linux over libteec by unmodified wolfTPM examples.

The Jetson already ships a firmware TPM, but it reports TPM 2.0 spec revision 1.62 and so has no ML-DSA or ML-KEM, which arrive in revision 1.85. This port puts a 1.85 TPM on the same silicon alongside it.

Adds

• ta/ - user_ta_header_defines.h, the stack and heap sizes, and sub.mk. The entry points, NV HAL and wolfCrypt platform layer come from wolfTPM and wolfSSL, since none of them is board specific
• ta/prep.sh - symlinks the wolfCrypt, fwTPM and port sources plus the include roots into the build directory, because the OP-TEE build resolves srcs-y and global-incdirs-y against the sub.mk directory. Also generates uuid.mk and uuid_macro.inc from WOLFTPM_OPTEE_TA_UUID_STR in wolfTPM, and refuses a configured wolfSSL tree, whose generated config.h at the tree root would otherwise shadow the OP-TEE devkit's own and fail inside user_ta_header.c
• user_settings.h - one file configuring wolfCrypt and wolfTPM, via WOLFSSL_USER_SETTINGS and WOLFTPM_USER_SETTINGS as the STM32 port does. No generated options.h
• host/ - a minimal libteec client, built on the board
• native/ - a host build of the same sources driving FWTPM_ProcessCommand through a RAM NV HAL, for changing the port under a debugger and the sanitizers. It stands in for the TEE RNG, because NO_FILESYSTEM closes the host seed path
• sweep.sh - finds the TA_DATA_SIZE and TA_STACK_SIZE floors on a board
• the aarch64 assembly, on by default: sp_arm64.c for RSA and ECC, and the ARMv8 crypto extensions for AES, SHA-2, the ML-KEM transform and Keccak. Each has an opt-out, FWTPM_TA_NO_SP_ASM and FWTPM_TA_NO_ARMASM, because the single precision tables roughly double the trusted application. The README carries the sizes and what each buys
• kernel/tpm_wolftpm_tee.patch - a diff against Linux v5.15's drivers/char/tpm/tpm_ftpm_tee.c that points it at this UUID, so the firmware TPM appears as /dev/tpm1 and standard Linux tooling can drive it. The driver is GPL-2.0 and is not vendored here; the README has the build recipe

Requires the WOLFTPM_OPTEE support in wolfTPM, which supplies src/fwtpm/ports/optee/ and wolftpm/fwtpm/fwtpm_optee.h (wolfSSL/wolfTPM#659), and the WOLFSSL_OPTEE support from wolfSSL/wolfssl#11919 and wolfSSL/wolfssl#11927, which supply the build environment and the heap, RNG and time mapping, and are why there are no wolfCrypt platform shims here.

Testing

Validated on a Jetson Orin Nano (L4T R36.4.4). Reports Mfg WOLF (0), Vendor wolfTPM with TPM_PT_REVISION 185. Unmodified caps, getrandom, native_test, wrap_test and the four pqc/ examples pass, and NV persists across separate client processes.