[[PATCH v2] tpm: Add wolfTPM library support for TPM 2.0 06/12] tpm: add wolfTPM headers and SHA384 glue code
David Garske
david at wolfssl.com
Mon Mar 16 19:14:35 CET 2026
From: Aidan <aidan at wolfssl.com>
Add the wolfTPM integration headers and hash wrapper needed to bridge
wolfTPM with U-Boot's subsystems.
include/wolftpm.h:
Public header exposing TPM2_PCRs_Print(), TPM2_Init_Device(), and
Infineon firmware update helpers (TPM2_IFX_FwData_Cb,
TPM2_IFX_GetOpModeStr, TPM2_IFX_PrintInfo). Includes the core
wolfTPM headers (tpm2.h, tpm2_wrap.h, tpm2_packet.h).
include/configs/user_settings.h:
wolfTPM compile-time configuration. Selects TPM chip type
(SLB9672/SLB9673 for real hardware, WOLFTPM_AUTODETECT for
swtpm/QEMU), communication mode (native SPI TIS layer for real
hardware, WOLFTPM_LINUX_DEV for U-Boot driver model), timeout
tuning, and feature flags (WOLFTPM2_NO_WOLFCRYPT,
WOLFTPM2_NO_HEAP, WOLFTPM_CHECK_WAIT_STATE).
lib/wolftpm.c:
Provides wc_Sha384Hash() implementation when wolfCrypt is disabled
(WOLFTPM2_NO_WOLFCRYPT). Uses U-Boot's hash_lookup_algo("sha384")
to compute SHA-384 digests, which is required for Infineon TPM
firmware update manifest validation.
Signed-off-by: Aidan Garske <aidan at wolfssl.com>
---
include/configs/user_settings.h | 118 ++++++++++++++++++++++++++++++++
include/wolftpm.h | 34 +++++++++
lib/wolftpm.c | 56 +++++++++++++++
3 files changed, 208 insertions(+)
create mode 100644 include/configs/user_settings.h
create mode 100644 include/wolftpm.h
create mode 100644 lib/wolftpm.c
diff --git a/include/configs/user_settings.h b/include/configs/user_settings.h
new file mode 100644
index 00000000000..e62be7a8f30
--- /dev/null
+++ b/include/configs/user_settings.h
@@ -0,0 +1,118 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * wolfTPM build configuration for U-Boot
+ *
+ * Copyright (C) 2025 wolfSSL Inc.
+ * Author: Aidan Garske <aidan at wolfssl.com>
+ */
+
+#ifndef USER_SETTINGS_H
+#define USER_SETTINGS_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/******************************************************************************/
+/* --- BEGIN wolfTPM U-boot Settings -- */
+/******************************************************************************/
+
+/* =========================================================================
+ * TPM Chip Configuration
+ * =========================================================================
+ *
+ * CONFIG_TPM_AUTODETECT: For swtpm/QEMU testing (no specific chip)
+ * !CONFIG_TPM_AUTODETECT: For real hardware (SLB9672/SLB9673)
+ */
+#ifdef CONFIG_TPM_AUTODETECT
+ #define WOLFTPM_AUTODETECT
+#else
+ /* Real hardware - Infineon SLB9672/SLB9673
+ * Firmware upgrade only supported by these chips */
+ #define WOLFTPM_FIRMWARE_UPGRADE
+ #define WOLFTPM_SLB9672
+ /* #define WOLFTPM_SLB9673 */
+#endif
+
+/* Include delay.h and types.h for
+ * U-boot time delay and types */
+#include <linux/delay.h>
+#include <linux/types.h>
+#include <stdint.h>
+
+/* wolfCrypt disabled - pcr_setauthpolicy/pcr_setauthvalue not available
+ * To enable wolfCrypt, you would need to:
+ * 1. Uncomment the line below to undefine WOLFTPM2_NO_WOLFCRYPT
+ * 2. Add wolfCrypt source files to the U-Boot build (lib/Makefile)
+ * 3. Add wolfCrypt settings for embedded/no-OS use
+ */
+#undef WOLFTPM2_NO_WOLFCRYPT
+#define WOLFTPM2_NO_WOLFCRYPT
+
+/* =========================================================================
+ * TPM Communication Mode Selection (Auto-detected based on chip type)
+ * =========================================================================
+ *
+ * For real SPI hardware (SLB9672/SLB9673):
+ * - Uses wolfTPM's native TIS layer with raw SPI via tpm_io_uboot.c
+ * - Requires CONFIG_SPI and CONFIG_DM_SPI enabled in U-Boot
+ *
+ * For swtpm/QEMU testing (no specific chip defined):
+ * - Uses WOLFTPM_LINUX_DEV mode with U-Boot's TPM driver (tpm_xfer())
+ * - Works with MMIO-based TPM via tpm2_tis_mmio.c
+ */
+
+#if defined(WOLFTPM_SLB9672) || defined(WOLFTPM_SLB9673)
+ /* Real SPI hardware - use native wolfTPM TIS with raw SPI */
+ /* WOLFTPM_LINUX_DEV is NOT defined */
+ #define WOLFTPM_EXAMPLE_HAL
+
+ /* SPI bus and chip select for TPM
+ * Official Raspberry Pi tpm-slb9670 overlay uses CE1 (GPIO7)
+ * This matches LetsTrust and most Infineon evaluation boards */
+ #ifndef TPM_SPI_BUS
+ #define TPM_SPI_BUS 0
+ #endif
+ #ifndef TPM_SPI_CS
+ #define TPM_SPI_CS 1 /* CE1/GPIO7 - official RPi TPM overlay setting */
+ #endif
+#else
+ /* swtpm/QEMU - use U-Boot's TPM driver with MMIO communication mode */
+ #define WOLFTPM_LINUX_DEV
+#endif
+
+#define XSLEEP_MS(ms) udelay(ms * 1000)
+
+/* Timeout configuration */
+#ifdef WOLFTPM_FIRMWARE_UPGRADE
+ /* Firmware update requires much longer timeout for TPM processing */
+ #define TPM_TIMEOUT_TRIES 2000000
+#else
+ /* Normal operations - reduce from default 1,000,000 to prevent long hangs */
+ #define TPM_TIMEOUT_TRIES 10000
+#endif
+
+/* Add small delay between poll attempts to avoid tight spin loop */
+#define XTPM_WAIT() udelay(100)
+
+/* Do not include API's that use heap(), they are not required */
+#define WOLFTPM2_NO_HEAP
+
+/* Debugging - disabled for clean output */
+/* #define DEBUG_WOLFTPM */
+/* #define WOLFTPM_DEBUG_VERBOSE */
+/* #define WOLFTPM_DEBUG_IO */
+/* #define WOLFTPM_DEBUG_TIMEOUT */
+
+/* SPI Wait state checking - most TPMs use this */
+#define WOLFTPM_CHECK_WAIT_STATE
+
+/******************************************************************************/
+/* --- END wolfTPM U-boot Settings -- */
+/******************************************************************************/
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* USER_SETTINGS_H */
diff --git a/include/wolftpm.h b/include/wolftpm.h
new file mode 100644
index 00000000000..a3cd9d0d2dd
--- /dev/null
+++ b/include/wolftpm.h
@@ -0,0 +1,34 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * wolfTPM integration header for U-Boot
+ *
+ * Copyright (C) 2025 wolfSSL Inc.
+ * Author: Aidan Garske <aidan at wolfssl.com>
+ */
+
+#ifndef __WOLFTPM_H__
+#define __WOLFTPM_H__
+
+#include <wolftpm/tpm2.h>
+#include <wolftpm/tpm2_wrap.h>
+#include <wolftpm/tpm2_packet.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifdef WOLFTPM_FIRMWARE_UPGRADE
+int TPM2_IFX_FwData_Cb(uint8_t *data, uint32_t data_req_sz,
+ uint32_t offset, void *cb_ctx);
+const char *TPM2_IFX_GetOpModeStr(int opMode);
+void TPM2_IFX_PrintInfo(WOLFTPM2_CAPS *caps);
+#endif
+
+int TPM2_PCRs_Print(void);
+int TPM2_Init_Device(WOLFTPM2_DEV *dev, void *userCtx);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* __WOLFTPM_H__ */
diff --git a/lib/wolftpm.c b/lib/wolftpm.c
new file mode 100644
index 00000000000..49e35401236
--- /dev/null
+++ b/lib/wolftpm.c
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * wolfTPM wrapper layer for U-Boot
+ *
+ * Copyright (C) 2025 wolfSSL Inc.
+ * Author: Aidan Garske <aidan at wolfssl.com>
+ */
+
+/* wolfTPM wrapper layer to expose U-boot API
+ * when wolfCrypt is not available. This is used by
+ * the U-boot firmware update command.
+ */
+
+#include <configs/user_settings.h>
+#include <hash.h>
+#include <linux/types.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+#include <malloc.h>
+#include <mapmem.h>
+#include <asm/cache.h>
+#include <errno.h>
+
+/* Add wolfTPM type definitions */
+typedef uint8_t byte;
+typedef uint32_t word32;
+
+#ifdef WOLFTPM2_NO_WOLFCRYPT
+int wc_Sha384Hash(const byte *data, word32 len, byte *hash)
+{
+ struct hash_algo *algo;
+ u8 *output;
+ void *buf;
+
+ if (hash_lookup_algo("sha384", &algo)) {
+ printf("Unknown hash algorithm 'sha384'\n");
+ return -1;
+ }
+
+ output = (u8 *)memalign(ARCH_DMA_MINALIGN,
+ algo->digest_size);
+ if (!output) {
+ return -ENOMEM;
+ }
+
+ buf = (void *)map_sysmem((ulong)data, len);
+ algo->hash_func_ws(buf, len, output, algo->chunk_size);
+ unmap_sysmem(buf);
+
+ memcpy(hash, output, algo->digest_size);
+
+ free(output);
+ return 0;
+}
+#endif /* WOLFTPM2_NO_WOLFCRYPT */
--
2.43.0
More information about the U-Boot
mailing list