Add finer per-command-group gating macros in fTPM

[dgarske]

Summary

Adds opt-in macros that let a firmware-TPM (fwTPM) build compile out command groups it does not need, so wolfTPM's fwTPM can fit deeply memory-constrained targets. All new macros default OFF, so the default fwTPM command set is unchanged and no existing build is affected.

What is added

Six new per-group gates plus one umbrella, following the existing FWTPM_NO_POLICY / NO_ATTESTATION / NO_CREDENTIAL / NO_DA / NO_PARAM_ENC precedent:

Macro	Compiles out
FWTPM_NO_KEY_MIGRATION	Import, Duplicate, Rewrap (keeps the shared wrap/import helpers, LoadExternal, CreateLoaded)
FWTPM_NO_ECDH	ECDH_KeyGen, ECDH_ZGen, EC_Ephemeral, ZGen_2Phase, ECC_Parameters (and the ecEphemeral* context fields)
FWTPM_NO_HASH_CMDS	Hash, HMAC and the hash sequence commands (kept alive when WOLFTPM_MLDSA still needs the shared sequence path)
FWTPM_NO_CONTEXT	ContextSave, ContextLoad (keeps FlushContext)
FWTPM_NO_SYM_ENCRYPT	EncryptDecrypt, EncryptDecrypt2
FWTPM_NO_CLOCK	ReadClock, ClockSet, ClockRateAdjust

There is intentionally no "minimal" umbrella macro: dropping a command group removes real TPM functionality, so a build must select each gate deliberately rather than flipping one switch. Applying all six new gates plus the five pre-existing FWTPM_NO_* gates leaves a core fTPM (Startup / GetCapability / GetRandom / PCR / Create / Load / Sign / VerifySignature / NV / sessions).

Why it is safe

TPM2_GetCapability derives the advertised command list and TPM_PT_TOTAL_COMMANDS from the same fwCmdTable[] dispatch table, so removing a table row removes the command from capability reporting automatically - no separate GetCapability edits are needed and a gated command cannot be advertised-but-missing. Shared helpers used by the retained commands (key wrap/import, hash sequence lookups used by MLDSA signing, FlushContext) are explicitly kept. The MLDSA sign path shares the TPM sequence commands, so those are guarded with #if !defined(FWTPM_NO_HASH_CMDS) || defined(WOLFTPM_MLDSA) to avoid breaking a gated + MLDSA build.

Footprint impact

On a 32-bit RISC-V -Os build, enabling all of these gates removes roughly 20 KB of code from the fwTPM command engine. Combined with a hardware-TRNG entropy source this is what lets an ECC-only fwTPM fit a 192 KB soft-core target (see the AMD SCU35 example in wolftpm-examples, which selects the gate set explicitly in its user_settings.h).

Testing

• Compile-clean across every new -DFWTPM_NO_* flag individually and with all of them enabled together, including the FWTPM_NO_HASH_CMDS + WOLFTPM_MLDSA combination.
• CI (.github/workflows/fwtpm-test.yml): build-only matrix entries for each new flag plus an all-gates-together build standalone and with MLDSA. Functional unit tests continue to run on the default (full) build; gated commands are guarded there by the matching #ifndef.

Docs

docs/FWTPM.md feature-group table (new macros + the previously missing FWTPM_NO_PARAM_ENC row), src/fwtpm/README.md (macro list + build-only matrix rows), root README.md, and a ChangeLog.md entry.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds opt-in compile-time gates to selectively compile out additional fwTPM command groups, reducing fTPM footprint on constrained targets while keeping the default command set unchanged.

Changes:

• Introduces new FWTPM_NO_* macros for finer per-command-group feature gating (clock, context, key migration, ECDH, hash cmds, symmetric encrypt).
• Updates the fwTPM dispatch table and command implementations to honor the new gates (including MLDSA-specific exceptions for shared sequences).
• Expands documentation and CI build matrix coverage for the new configuration combinations.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
wolftpm/fwtpm/fwtpm.h	Documents the new command-group gating macros and intended usage.
src/fwtpm/fwtpm_command.c	Wraps command handlers and fwCmdTable[] entries with new per-group #ifndef gates.
src/fwtpm/README.md	Documents new macros and adds CI matrix rows describing the build-only configurations.
docs/FWTPM.md	Updates feature-gating table and rewrites the “minimal build example” for explicit gate selection.
README.md	Updates top-level feature blurb to mention per-command-group feature selection.
.github/workflows/fwtpm-test.yml	Adds build-only CI jobs for each new gate and for “all gates” configurations (incl. MLDSA).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[aidangarske]

Skoll Multi-Scan Review

Modes: review + review-security

Overall recommendation: COMMENT
Findings: 5 total — 5 posted, 0 skipped
5 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] [review+review-security] ML-DSA build retains an unusable SequenceComplete command — src/fwtpm/fwtpm_command.c:16211-16214
• [Medium] [review+review-security] Feature gates retain per-instance FWTPM_CTX storage that is no longer reachable — wolftpm/fwtpm/fwtpm.h:123-129
• [Medium] [review+review-security] New feature gates receive no behavioral/runtime test coverage — .github/workflows/fwtpm-test.yml:153-232
• [Medium] [review] Reduced-PCR table change lacks a reduced-PCR build test — src/fwtpm/fwtpm_command.c:2148-2188
• [Medium] [review] Command coverage docs still label newly gated commands as always enabled — src/fwtpm/README.md:232-245

Review generated by Skoll

[aidangarske]

Looks good!