Add STM33TPM Firmware Update Support for LMS/non-LMS

[aidangarske]

Description

This PR adds comprehensive firmware update support for STMicroelectronics ST33KTPM2X TPM modules, including both legacy non-LMS and modern LMS (Leighton-Micali Signature) signature formats.

Overview

The implementation supports firmware updates for ST33 TPMs across two firmware generations:

• Generation 1 (< 512): Legacy firmware requiring non-LMS format (177-byte manifest)
• Generation 2 (>= 512): Modern firmware requiring LMS format (2697-byte manifest with embedded signature)

Main Functions Created

Core API Functions

1. wolfTPM2_FirmwareUpgradeHash() - Main firmware upgrade function

   • Handles version detection and routes to appropriate path (non-LMS or LMS)
   • Sends full manifest (blob0) directly to TPM via FieldUpgradeStart command
   • Processes firmware data as blobs per ST reference implementation
   • Supports recovery/continuation from TPM_RC_UPGRADE state

2. wolfTPM2_FirmwareUpgradeCancel() - Cancel/abandon firmware update

   • Allows cancellation of in-progress firmware updates
   • Uses ST33's password-based authentication (TPM_RS_PW)

Helper Functions

• tpm2_st33_firmware_start() - Non-LMS firmware upgrade start
• tpm2_st33_firmware_start_lms() - LMS firmware upgrade start
• tpm2_st33_firmware_upgrade_hash() - Version detection and routing logic
• tpm2_st33_firmware_send_blob() - Send firmware blob chunks to TPM

Key Implementation Details

Firmware Version Detection

The implementation uses a simplified two-state model matching ST's reference tools:

• Firmware < 512 (e.g., 9.257): Legacy Generation 1, non-LMS format required
• Firmware >= 512 (e.g., 9.512): Modern Generation 2, LMS format required

Version threshold is 512 (0x0200), matching ST's policy where 9.512 is the first firmware version that mandates LMS signatures.

Versions are detected based on manifest size

Testing

All functionality was tested on real ST33KTPM2X hardware:

• Firmware 9.256 (legacy): Verified non-LMS firmware update path
• Firmware 9.512 (modern): Verified LMS format detection, enforcement, and successful updates

Tested firmware update and all examples

Added test script (examples/firmware/test_st33_firmware.sh) with autodetected version type

• updated .github/workflows/cmake-build.yml with --enable-firmware
• updated .github/workflows/make-test-swtpm.yml with --enable-firmware

[dgarske]

Very close!