wolfBoot/docs/fwTPM.md

wolfBoot fwTPM on STM32H5

wolfBoot can host wolfTPM's firmware TPM 2.0 implementation in the secure TrustZone image and expose it to the non-secure application through the wolfBoot callable service interface. This lets the non-secure application use the normal wolfTPM client API while TPM commands are processed inside the secure world.

The feature is intended for STM32H5 TrustZone builds. The secure image contains the fwTPM command processor and the non-secure test application uses a small TIS shim that forwards commands through the NSC entry point.

Configuration

Use these wolfBoot configuration options:

Option	Effect
TZEN=1	Builds wolfBoot for TrustZone-enabled STM32H5 parts.
WOLFCRYPT_TZ=1	Enables the wolfCrypt secure callable service layer.
WOLFCRYPT_TZ_FWTPM=1	Enables the secure fwTPM service and non-secure fwTPM test support.

WOLFCRYPT_TZ_FWTPM=1 defines WOLFBOOT_TZ_FWTPM for the secure and non-secure builds. It also enables wolfTPM fwTPM sources, WOLFTPM_FWTPM, FWTPM_NO_NV, and the callable fwTPM object.

The ready-to-use STM32H5 configuration is:

cp config/examples/stm32h5-tz-fwtpm.config .config

Build

Build wolfBoot and the signed STM32H5 test application from the repository root:

cp config/examples/stm32h5-tz-fwtpm.config .config
make clean
make
make test-app/image_v1_signed.bin

The main outputs are:

Output	Description
wolfboot.bin	Secure wolfBoot image with the fwTPM service.
test-app/image_v1_signed.bin	Signed non-secure STM32H5 test application.
test-app/image.elf	Non-secure test application ELF for debugging.

Flash on STM32H5

Enable TrustZone and program the secure and non-secure images with STM32CubeProgrammer:

STM32_Programmer_CLI -c port=swd mode=hotplug -ob TZEN=0xB4
STM32_Programmer_CLI -c port=swd -d wolfboot.bin 0x0C000000
STM32_Programmer_CLI -c port=swd -d test-app/image_v1_signed.bin 0x08060000

The addresses above match config/examples/stm32h5-tz-fwtpm.config:

Region	Address
Secure wolfBoot image	0x0C000000
Non-secure boot partition	0x08060000
Non-secure update partition	0x0C100000
Swap partition	0x0C1A0000
NSC veneer region	0x0C05C000

Test

Open the board serial console and run the fwTPM test command:

fwtpm

The test application initializes wolfTPM using the non-secure TIS callback, queries capabilities, requests random bytes, extends PCR 0, verifies the PCR value, and seals/unseals a PCR-bound secret. A successful run ends with:

fwTPM NSC tests passed

The STM32H5 test app also runs the same fwTPM test automatically during startup when built with WOLFBOOT_TZ_FWTPM.

Notes

The current wolfBoot integration builds the secure fwTPM service with FWTPM_NO_NV, so TPM NV state is not persistent across resets. To add persistent NV storage, provide a flash-backed FWTPM_NV_HAL implementation and remove FWTPM_NO_NV from the fwTPM build flags.

WOLFCRYPT_TZ_FWTPM is mutually exclusive with WOLFCRYPT_TZ_PKCS11 and WOLFCRYPT_TZ_PSA because each option selects a different TrustZone secure service surface for the test application.