Repository navigation
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Truncated PikeOS TPM responses can pass validation and return stale buffer contents as randomness, while cleanup can leak device descriptors for inactive contexts.
2 open issues
What changed in this PR
Adds PikeOS as a whole-command TPM transport, integrating its file-provider driver into wolfTPM without a TIS callback.
Changes:
- Adds device I/O and cleanup through PikeOS
vm_*APIs. - Integrates transport selection, driver-owned locality, and PikeOS timing helpers.
- Adds build options, usage documentation, and compile-only CI with SDK stubs.
| File | Description |
|---|---|
wolftpm/tpm2.h |
Adds per-context PikeOS device state. |
wolftpm/tpm2_types.h |
Adds PikeOS timeout and timing helpers. |
wolftpm/tpm2_pikeos.h |
Declares transport and cleanup functions. |
wolftpm/include.am |
Includes the PikeOS header in installation. |
src/tpm2.c |
Connects PikeOS dispatch, cleanup, and initialization. |
src/tpm2_wrap.c |
Adapts initialization, locality, and firmware-update paths. |
src/tpm2_spdm.c |
Excludes PikeOS from TIS-based SPDM I/O. |
src/tpm2_pikeos.c |
Implements file-provider command transport. |
src/include.am |
Adds the transport to Autotools sources. |
hal/tpm_io.h |
Defines a null I/O callback for PikeOS. |
hal/tpm_io.c |
Excludes callback implementation for PikeOS. |
examples/tpm_test.h |
Adds PikeOS example timing support. |
docs/hal-io-callback.md |
Lists PikeOS as a system interface. |
docs/getting-started.md |
Documents PikeOS disabling software-backend defaults. |
docs/build-options.md |
Documents configuration and runtime prerequisites. |
configure.ac |
Adds PikeOS selection and compatibility checks. |
CMakeLists.txt |
Adds the PIKEOS interface option and source. |
.github/workflows/pikeos-build.yml |
Adds normal and debug compile checks using SDK stubs. |
Review effort: Balanced
Comment on lines
+75
to
+82
| /* The caller parses the TPM_Packet for correctness */ | ||
| if (e != P4_E_OK || readSz < TPM2_HEADER_SIZE) { | ||
| #ifdef DEBUG_WOLFTPM | ||
| printf("Failed read from %s: %d (size %d)\n", TPM2_PIKEOS_DEV, | ||
| (int)e, (int)readSz); | ||
| #endif | ||
| return TPM_RC_FAILURE; | ||
| } |
| #define TPM2_INTERNAL_CLEANUP(ctx) TPM2_WinApi_Cleanup(ctx) | ||
| #elif defined(WOLFTPM_PIKEOS) | ||
| #define INTERNAL_SEND_COMMAND TPM2_PIKEOS_SendCommand | ||
| #define TPM2_INTERNAL_CLEANUP(ctx) TPM2_PIKEOS_Cleanup(ctx) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.


Description
Adds
--enable-pikeos(CMakeWOLFTPM_INTERFACE=PIKEOS) for PikeOS, where the TPM driver is reached through the file provider (vm_open/vm_write/vm_read) and takes whole TPM commands, like the Linux/dev/tpm0transport.src/tpm2_pikeos.c,wolftpm/tpm2_pikeos.h: the transport. The device defaults totpm0:dev0; override withTPM2_PIKEOS_DEV.TPM2_IoCbis NULL and the driver owns locality. wolfTPM still sendsTPM2_Startup.wolftpm/tpm2_types.h,examples/tpm_test.h: sleep and time helpers usingp4_sleep/p4_get_time.p4.h/vm.h.Testing
Cross-compiled with the PikeOS 5.1 x86_64 SDK. Tested on a PikeOS target with an Infineon SLB9670 behind the PikeOS TPM driver:
capsandwrap_testpass.