From fce7087225165ccb6d76d55383b53e6a633de6cf Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Thu, 13 Aug 2026 10:28:35 -0700
Subject: [PATCH 1/2] F-9188 - Validate NV DefineSpace and UndefineSpace
 hierarchy authorization

---
 src/fwtpm/fwtpm_command.c | 37 +++++++++++++++++++++++++++++++++++--
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/src/fwtpm/fwtpm_command.c b/src/fwtpm/fwtpm_command.c
index 3457948a..8602c1f8 100644
--- a/src/fwtpm/fwtpm_command.c
+++ b/src/fwtpm/fwtpm_command.c
@@ -11494,6 +11494,11 @@ static TPM_RC FwCmd_NV_DefineSpace(FWTPM_CTX* ctx, TPM2_Packet* cmd,
     /* Skip auth area */
     if (cmdTag == TPM_ST_SESSIONS) rc = FwSkipAuthArea(cmd, cmdSize);
 
+    if (rc == 0 && authHandle != TPM_RH_OWNER &&
+        authHandle != TPM_RH_PLATFORM) {
+        rc = TPM_RC_HIERARCHY;
+    }
+
     /* 1st param: TPM2B_AUTH (NV auth value) */
     if (rc == 0) {
         TPM2_Packet_ParseU16(cmd, &auth.size);
@@ -11554,6 +11559,24 @@ static TPM_RC FwCmd_NV_DefineSpace(FWTPM_CTX* ctx, TPM2_Packet* cmd,
         }
     }
 
+    /* TPMA_NV_PLATFORMCREATE must be set under platform auth and clear under
+     * any other hierarchy (TPM 2.0 Part 3, NV_DefineSpace). */
+    if (rc == 0 && authHandle == TPM_RH_PLATFORM &&
+        (publicInfo.nvPublic.attributes & TPMA_NV_PLATFORMCREATE) == 0) {
+        rc = TPM_RC_ATTRIBUTES;
+    }
+    if (rc == 0 && authHandle != TPM_RH_PLATFORM &&
+        (publicInfo.nvPublic.attributes & TPMA_NV_PLATFORMCREATE)) {
+        rc = TPM_RC_ATTRIBUTES;
+    }
+
+    /* Only platform auth may set TPMA_NV_POLICY_DELETE; such an index can be
+     * removed only through UndefineSpaceSpecial. */
+    if (rc == 0 && authHandle != TPM_RH_PLATFORM &&
+        (publicInfo.nvPublic.attributes & TPMA_NV_POLICY_DELETE)) {
+        rc = TPM_RC_ATTRIBUTES;
+    }
+
     /* Check for duplicate */
     if (rc == 0 && FwFindNvIndex(ctx, publicInfo.nvPublic.nvIndex) != NULL) {
         rc = TPM_RC_NV_DEFINED;
@@ -11601,7 +11624,6 @@ static TPM_RC FwCmd_NV_DefineSpace(FWTPM_CTX* ctx, TPM2_Packet* cmd,
 
         FWTPM_NV_SaveNvIndex(ctx,
             (int)(slot - ctx->nvIndices));
-        (void)authHandle;
         FwRspNoParams(rsp, cmdTag);
     }
 
@@ -11624,8 +11646,13 @@ static TPM_RC FwCmd_NV_UndefineSpace(FWTPM_CTX* ctx, TPM2_Packet* cmd,
     TPM2_Packet_ParseU32(cmd, &nvHandle);
     if (cmdTag == TPM_ST_SESSIONS) rc = FwSkipAuthArea(cmd, cmdSize);
 
+    if (rc == 0 && authHandle != TPM_RH_OWNER &&
+        authHandle != TPM_RH_PLATFORM) {
+        rc = TPM_RC_HIERARCHY;
+    }
+
     nv = FwFindNvIndex(ctx, nvHandle);
-    if (nv == NULL) {
+    if (rc == 0 && nv == NULL) {
         rc = FW_NV_HANDLE_ERR_2;
     }
 
@@ -11634,6 +11661,12 @@ static TPM_RC FwCmd_NV_UndefineSpace(FWTPM_CTX* ctx, TPM2_Packet* cmd,
         rc = TPM_RC_ATTRIBUTES;
     }
 
+    /* A platform-created index can only be removed by the platform hierarchy */
+    if (rc == 0 && authHandle == TPM_RH_OWNER &&
+        (nv->nvPublic.attributes & TPMA_NV_PLATFORMCREATE)) {
+        rc = TPM_RC_NV_AUTHORIZATION;
+    }
+
     if (rc == 0) {
         XMEMSET(nv, 0, sizeof(FWTPM_NvIndex));
         FWTPM_NV_DeleteNvIndex(ctx, nvHandle);

From f28c8207ac67e004bc3f3edd15a234d6d00bc7d1 Mon Sep 17 00:00:00 2001
From: Aidan Garske <aidan@wolfssl.com>
Date: Thu, 13 Aug 2026 12:07:19 -0700
Subject: [PATCH 2/2] F-9211 - Report v1.85 revision and errata semantics in
 GetCapability

---
 src/fwtpm/fwtpm_command.c | 7 +++++++
 wolftpm/fwtpm/fwtpm.h     | 4 ++++
 2 files changed, 11 insertions(+)

diff --git a/src/fwtpm/fwtpm_command.c b/src/fwtpm/fwtpm_command.c
index 8602c1f8..ff6634ad 100644
--- a/src/fwtpm/fwtpm_command.c
+++ b/src/fwtpm/fwtpm_command.c
@@ -1349,8 +1349,15 @@ static TPM_RC FwCmd_GetCapability(FWTPM_CTX* ctx, TPM2_Packet* cmd,
                 { TPM_PT_FAMILY_INDICATOR,  0x322E3000 },
                 { TPM_PT_LEVEL,             0 },
                 { TPM_PT_REVISION,          FWTPM_REVISION },
+#ifdef WOLFTPM_V185
+                /* v1.85 Part 2 renames PT_FIXED+3 to TPM_PT_ERRATA (base value
+                 * 0) and no longer reports a build date at PT_FIXED+3/+4. */
+                { TPM_PT_DAY_OF_YEAR,       0 },
+                { TPM_PT_YEAR,              0 },
+#else
                 { TPM_PT_DAY_OF_YEAR,       FWTPM_BUILD_DAY_OF_YEAR },
                 { TPM_PT_YEAR,              FWTPM_BUILD_YEAR },
+#endif
                 { TPM_PT_MANUFACTURER,
                   ((UINT32)'W' << 24) | ((UINT32)'O' << 16) |
                   ((UINT32)'L' << 8)  | (UINT32)'F' },
diff --git a/wolftpm/fwtpm/fwtpm.h b/wolftpm/fwtpm/fwtpm.h
index f2d99c35..78b49f9e 100644
--- a/wolftpm/fwtpm/fwtpm.h
+++ b/wolftpm/fwtpm/fwtpm.h
@@ -295,8 +295,12 @@
 
 /* fwTPM firmware revision (TPM_PT_REVISION hundredths) */
 #ifndef FWTPM_REVISION
+#ifdef WOLFTPM_V185
+#define FWTPM_REVISION 185
+#else
 #define FWTPM_REVISION 159
 #endif
+#endif
 
 /* Compile-time build date parsed from __DATE__ ("Mmm DD YYYY") */
 #define FWTPM_BUILD_YEAR \