Add SealSQ QVault post-quantum TPM Support

[aidangarske]

Description

• Adds the --enable-sealsq vendor build: "SEAL" manufacturer detection, vendor ID 0x2406, and SPI CE0 chip-select / wait-state defaults.
• SEALSQ QVault TPM is the first shipping TPM 2.0 with v1.85 post-quantum (ML-DSA / ML-KEM) algorithms in silicon.
• New examples/pqc/pqc_ctrl control tool plus a pqc_ctrl.sh suite: caps, algorithm list, self-test, get-random, PCR read and extend, transient-object flush, TPM clear, and the full ML-DSA / Hash-ML-DSA / ML-KEM parameter
  matrix in one CLI.
• Arguments are validated before any operation runs; --clear and --pcrextend are opt-in via PQC_CTRL_CLEAR so a typo cannot wipe state or extend a PCR.
• Each key operation reclaims the loaded transient objects first, so the QVault TPM small object table does not hit TPM_RC_OBJECT_MEMORY when commands are chained.
• a --enable-sealsq vendor compile job, and pqc_ctrl.sh (full command set plus argument-validation negatives) run over the fwTPM.
• Docs: README features, PQC section, hardware list and device-ID, build-options entry, and measured QVault TPM benchmarks; plus examples/pqc/README.md.
• examples/pqc/pqc_ctrl.sh passes 20/20 on SealSQ QVault TPM hardware and 20/20 over the fwTPM

[Copilot]

Pull request overview

Adds SealSQ QVault vendor support to wolfTPM and introduces a new “PQC control center” example + CI coverage to exercise TPM 2.0 v1.85 post-quantum algorithms (ML-DSA / Hash-ML-DSA / ML-KEM) on both hardware and the in-tree fwTPM.

Changes:

• Add SealSQ vendor/manufacturer identification plus default SPI wait-state / bus-speed / chip-select settings.
• Add examples/pqc/pqc_ctrl and a pqc_ctrl.sh test suite to drive board/control operations and the full ML-DSA/ML-KEM parameter matrix with pre-validation.
• Extend build/CI plumbing (autoconf option + GitHub workflows) and documentation to include the new vendor and example tooling.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
wolftpm/tpm2.h	Add SealSQ vendor ID constant.
wolftpm/tpm2_wrap.h	Add SealSQ manufacturer enum value for wrapper-layer identification.
wolftpm/tpm2_types.h	Add SealSQ-specific SPI max Hz defaults and wait-state enablement.
src/tpm2_wrap.c	Detect "SEAL" manufacturer string and mark wait-state requirement.
hal/tpm_io_linux.c	Default SealSQ SPI chip-select to CE0 on Linux spidev.
configure.ac	Add --enable-sealsq autoconf option and selection logic.
README.md	Document SealSQ QVault support, build option, and benchmarks.
examples/pqc/pqc_ctrl.c	New PQC control tool implementing caps/algs/selftest/random/PCR ops + ML-DSA/ML-KEM matrix with argument validation.
examples/pqc/pqc_ctrl.sh	New shell suite to run pqc_ctrl command coverage and argument-validation negatives.
examples/pqc/include.am	Build/install distribution wiring for pqc_ctrl and pqc_ctrl.sh.
examples/pqc/README.md	Document pqc_ctrl usage and SealSQ QVault run context/benchmarks.
examples/run_examples.sh	Run pqc_ctrl board-control commands during v1.85 example runs.
.github/workflows/pqc-examples.yml	Run pqc_ctrl.sh in CI for fwTPM-based PQC examples.
.github/workflows/pqc-build-matrix.yml	Add a SealSQ vendor-config build job.
.gitignore	Ignore new pqc_ctrl and related generated example binaries.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #570

Scan targets checked: wolftpm-bugs, wolftpm-src

No new issues found in the changed files. ✅

[dgarske]

$ ./configure --enable-sealsq --enable-debug --enable-spi --enable-pqc && make
$ ./examples/pqc/pqc_ctrl 
TPM2: Caps 0x30000797, Did 0x0083, Vid 0x2406, Rid 0x 3 
TPM2_Startup pass
=== TPM control + PQC full matrix ===
Caps: Mfg SEAL, Vendor QVault TPM, Fw 2.1, FIPS 140-3
Supported algorithms (31):
  0x0001 RSA
  0x0005 HMAC
  0x0006 AES
  0x0007
  0x0008 KEYEDHASH
  0x000a
  0x000b SHA256
  0x000c SHA384
  0x000d SHA512
  0x0027
  0x0028
  0x0029
  0x0014
  0x0015
  0x0016
  0x0017
  0x0018
  0x0019
  0x001a
  0x0020
  0x0021
  0x0022
  0x0023 ECC
  0x0025
  0x0040
  0x0041
  0x0042
  0x0043
  0x00a1 ML-DSA
  0x00a2 Hash-ML-DSA
  0x00a0 ML-KEM
TPM2_SelfTest pass
PASS  SelfTest
Random 16 bytes: c18f1dc30eabf3958bd09c5a1febcc1e
TPM2_PCR_Read: Index 0, Digest Sz 48, Update Counter 21
	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................
PCR0 (SHA384): 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
TPM2_CreatePrimary: 0x80000000 (1327 bytes)
PASS  ML-DSA-44       sign+verify (sig 2420 bytes)
TPM2_FlushContext: Closed handle 0x80000000
TPM2_CreatePrimary: 0x80000000 (1967 bytes)
PASS  ML-DSA-65       sign+verify (sig 3309 bytes)
TPM2_FlushContext: Closed handle 0x80000000
TPM2_CreatePrimary: 0x80000000 (2607 bytes)
PASS  ML-DSA-87       sign+verify (sig 4627 bytes)
TPM2_FlushContext: Closed handle 0x80000000
TPM2_CreatePrimary: 0x80000000 (1328 bytes)
PASS  HashML-DSA-44   signdigest+verify (sig 2420 bytes)
TPM2_FlushContext: Closed handle 0x80000000
TPM2_CreatePrimary: 0x80000000 (1968 bytes)
PASS  HashML-DSA-65   signdigest+verify (sig 3309 bytes)
TPM2_FlushContext: Closed handle 0x80000000
TPM2_CreatePrimary: 0x80000000 (2608 bytes)
PASS  HashML-DSA-87   signdigest+verify (sig 4627 bytes)
TPM2_FlushContext: Closed handle 0x80000000
TPM2_CreatePrimary: 0x80000000 (816 bytes)
PASS  ML-KEM-512      encap+decap (ct 768 bytes)
TPM2_FlushContext: Closed handle 0x80000000
TPM2_CreatePrimary: 0x80000000 (1200 bytes)
PASS  ML-KEM-768      encap+decap (ct 1088 bytes)
TPM2_FlushContext: Closed handle 0x80000000
TPM2_CreatePrimary: 0x80000000 (1584 bytes)
PASS  ML-KEM-1024      encap+decap (ct 1568 bytes)
TPM2_FlushContext: Closed handle 0x80000000