Skip to content

Add PikeOS TPM driver transport (--enable-pikeos) - #657

Draft
dgarske wants to merge 1 commit into
wolfSSL:masterfrom
dgarske:pikeos
Draft

dgarske wants to merge 1 commit into
wolfSSL:masterfrom
dgarske:pikeos

Conversation

@dgarske

@dgarske dgarske commented Oct 28, 2026 •

Copy link
Copy Markdown
Member

Description

Adds --enable-pikeos (CMake WOLFTPM_INTERFACE=PIKEOS) for PikeOS, where the TPM driver is reached through the file provider (vm_open/vm_write/vm_read) and takes whole TPM commands, like the Linux /dev/tpm0 transport.

  • src/tpm2_pikeos.c, wolftpm/tpm2_pikeos.h: the transport. The device defaults to tpm0:dev0; override with TPM2_PIKEOS_DEV.
  • No TIS layer: TPM2_IoCb is NULL and the driver owns locality. wolfTPM still sends TPM2_Startup.
  • wolftpm/tpm2_types.h, examples/tpm_test.h: sleep and time helpers using p4_sleep/p4_get_time.
  • CI: compile-only job with stub p4.h/vm.h.

Testing

Cross-compiled with the PikeOS 5.1 x86_64 SDK. Tested on a PikeOS target with an Infineon SLB9670 behind the PikeOS TPM driver: caps and wrap_test pass.

@dgarske dgarske self-assigned this Oct 28, 2026
Copilot AI balanced review requested due to automatic review settings November 3, 2026 20:24

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Truncated PikeOS TPM responses can pass validation and return stale buffer contents as randomness, while cleanup can leak device descriptors for inactive contexts.

2 open issues
What changed in this PR

Adds PikeOS as a whole-command TPM transport, integrating its file-provider driver into wolfTPM without a TIS callback.

Changes:

  • Adds device I/O and cleanup through PikeOS vm_* APIs.
  • Integrates transport selection, driver-owned locality, and PikeOS timing helpers.
  • Adds build options, usage documentation, and compile-only CI with SDK stubs.
File Description
wolftpm/​tpm2.h Adds per-context PikeOS device state.
wolftpm/​tpm2_types.h Adds PikeOS timeout and timing helpers.
wolftpm/​tpm2_pikeos.h Declares transport and cleanup functions.
wolftpm/​include.am Includes the PikeOS header in installation.
src/​tpm2.c Connects PikeOS dispatch, cleanup, and initialization.
src/​tpm2_wrap.c Adapts initialization, locality, and firmware-update paths.
src/​tpm2_spdm.c Excludes PikeOS from TIS-based SPDM I/O.
src/​tpm2_pikeos.c Implements file-provider command transport.
src/​include.am Adds the transport to Autotools sources.
hal/​tpm_io.h Defines a null I/O callback for PikeOS.
hal/​tpm_io.c Excludes callback implementation for PikeOS.
examples/​tpm_test.h Adds PikeOS example timing support.
docs/​hal-io-callback.md Lists PikeOS as a system interface.
docs/​getting-started.md Documents PikeOS disabling software-backend defaults.
docs/​build-options.md Documents configuration and runtime prerequisites.
configure.ac Adds PikeOS selection and compatibility checks.
CMakeLists.txt Adds the PIKEOS interface option and source.
.github/​workflows/​pikeos-build.yml Adds normal and debug compile checks using SDK stubs.

Review effort: Balanced

Comment thread src/tpm2_pikeos.c
Comment on lines +75 to +82
/* The caller parses the TPM_Packet for correctness */
if (e != P4_E_OK || readSz < TPM2_HEADER_SIZE) {
#ifdef DEBUG_WOLFTPM
printf("Failed read from %s: %d (size %d)\n", TPM2_PIKEOS_DEV,
(int)e, (int)readSz);
#endif
return TPM_RC_FAILURE;
}
Comment thread src/tpm2.c
#define TPM2_INTERNAL_CLEANUP(ctx) TPM2_WinApi_Cleanup(ctx)
#elif defined(WOLFTPM_PIKEOS)
#define INTERNAL_SEND_COMMAND TPM2_PIKEOS_SendCommand
#define TPM2_INTERNAL_CLEANUP(ctx) TPM2_PIKEOS_Cleanup(ctx)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants