[[PATCH v2] tpm: Add wolfTPM library support for TPM 2.0 07/12] tpm: add wolfTPM driver helpers and Kconfig options
David Garske
david at wolfssl.com
Mon Mar 16 19:14:36 CET 2026
From: Aidan <aidan at wolfssl.com>
Add wolfTPM helper functions and configuration options to the TPM
driver subsystem.
drivers/tpm/wolftpm_common.c:
Shared helper functions used by the wolfTPM command backend:
- TPM2_IFX_FwData_Cb(): firmware data callback for Infineon
firmware update streaming
- TPM2_IFX_GetOpModeStr(): converts Infineon operational mode
codes to human-readable strings
- TPM2_IFX_PrintInfo(): prints manufacturer, vendor, firmware
version, and operational mode from WOLFTPM2_CAPS
- TPM2_PCRs_Print(): enumerates and prints assigned PCR banks
and their selected PCR indices
- TPM2_Init_Device(): initializes wolfTPM with the TPM2_IoCb
HAL callback
drivers/tpm/Kconfig:
Adds configuration options under TPM_V2:
- TPM2_SPI_SANDBOX: sandbox TPM SPI emulator for testing
- TPM_AUTODETECT: auto-detect TPM chip for swtpm/QEMU
- WOLFTPM_LINUX_DEV: use U-Boot driver model instead of
wolfTPM's native TIS layer
- WOLFTPM_SLB9672/SLB9673: Infineon chip-specific features
- WOLFTPM_FIRMWARE_UPGRADE: firmware update support
drivers/tpm/Makefile:
Compiles wolftpm_common.o and sets wolfTPM include paths and
-DWOLFTPM_USER_SETTINGS when CONFIG_TPM_WOLF is enabled.
Signed-off-by: Aidan Garske <aidan at wolfssl.com>
---
drivers/tpm/Kconfig | 44 +++++++++++
drivers/tpm/Makefile | 9 +++
drivers/tpm/wolftpm_common.c | 137 +++++++++++++++++++++++++++++++++++
3 files changed, 190 insertions(+)
create mode 100644 drivers/tpm/wolftpm_common.c
diff --git a/drivers/tpm/Kconfig b/drivers/tpm/Kconfig
index 219ea606b50..a2897a0e040 100644
--- a/drivers/tpm/Kconfig
+++ b/drivers/tpm/Kconfig
@@ -158,6 +158,14 @@ config TPM2_TIS_SANDBOX
such as basic configuration, PCR extension and PCR read. Extended
functionalities are not implemented.
+config TPM2_SPI_SANDBOX
+ bool "Enable sandbox TPM SPI emulator"
+ depends on TPM_V2 && SANDBOX && DM_SPI
+ help
+ This driver emulates a TPM connected via SPI for sandbox testing.
+ It implements the TPM TIS SPI protocol and can be used to test
+ wolfTPM SPI HAL code without physical hardware.
+
config TPM2_TIS_SPI
bool "Enable support for TPMv2.x SPI chips"
depends on TPM_V2 && DM_SPI
@@ -200,6 +208,42 @@ config TPM2_EVENT_LOG_SIZE
allocated twice. One for the eventlog it self and one for the
configuration table that is required from the TCG2 spec
+config TPM_AUTODETECT
+ bool "wolfTPM auto-detect TPM chip (for swtpm/QEMU)"
+ depends on TPM_V2 && TPM_WOLF
+ help
+ Enable wolfTPM chip auto-detection instead of using a specific
+ chip type (SLB9672/SLB9673). Use this for swtpm/QEMU testing
+ where no specific hardware chip is present.
+
+config WOLFTPM_LINUX_DEV
+ bool "Use device-level TPM interface (bypass wolfTPM TIS layer)"
+ depends on TPM_V2 && TPM_WOLF
+ default y
+ help
+ Enable wolfTPM to use the underlying TPM driver instead of its own
+ TIS (TPM Interface Specification) layer. On U-Boot, this uses the
+ U-Boot TPM driver model (tpm_xfer). On Linux, this uses /dev/tpm0.
+ This is the recommended setting for U-Boot.
+
+config WOLFTPM_SLB9672
+ bool "Enable support for Infineon SLB9672 TPM"
+ depends on TPM_V2 && TPM_WOLF
+ help
+ Enable support for Infineon SLB9672 TPM features in wolfTPM.
+
+config WOLFTPM_SLB9673
+ bool "Enable support for Infineon SLB9673 TPM"
+ depends on TPM_V2 && TPM_WOLF
+ help
+ Enable support for Infineon SLB9673 TPM features in wolfTPM.
+
+config WOLFTPM_FIRMWARE_UPGRADE
+ bool "Enable firmware upgrade support for wolfTPM"
+ depends on TPM_V2 && TPM_WOLF
+ help
+ Enable support for Infineon TPM firmware upgrade commands in wolfTPM.
+
endif # TPM_V2
endmenu
diff --git a/drivers/tpm/Makefile b/drivers/tpm/Makefile
index b83ce703ec0..bee4193e9fc 100644
--- a/drivers/tpm/Makefile
+++ b/drivers/tpm/Makefile
@@ -10,7 +10,16 @@ obj-$(CONFIG_TPM_TIS_SANDBOX) += tpm_tis_sandbox.o sandbox_common.o
obj-$(CONFIG_$(PHASE_)TPM2_CR50_I2C) += cr50_i2c.o
obj-$(CONFIG_TPM2_TIS_SANDBOX) += tpm2_tis_sandbox.o sandbox_common.o
+obj-$(CONFIG_TPM2_SPI_SANDBOX) += tpm_spi_sandbox.o
obj-$(CONFIG_TPM2_TIS_SPI) += tpm2_tis_core.o tpm2_tis_spi.o
obj-$(CONFIG_TPM2_TIS_I2C) += tpm2_tis_core.o tpm2_tis_i2c.o
obj-$(CONFIG_TPM2_FTPM_TEE) += tpm2_ftpm_tee.o
obj-$(CONFIG_TPM2_MMIO) += tpm2_tis_core.o tpm2_tis_mmio.o
+
+# wolfTPM helper functions
+ifeq ($(CONFIG_TPM_WOLF),y)
+ccflags-y += -I$(srctree)/lib/wolftpm \
+ -I$(srctree)/include/configs \
+ -DWOLFTPM_USER_SETTINGS
+obj-y += wolftpm_common.o
+endif
diff --git a/drivers/tpm/wolftpm_common.c b/drivers/tpm/wolftpm_common.c
new file mode 100644
index 00000000000..bea36cf0229
--- /dev/null
+++ b/drivers/tpm/wolftpm_common.c
@@ -0,0 +1,137 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * wolfTPM common helper functions for U-Boot
+ *
+ * Copyright (C) 2025 wolfSSL Inc.
+ * Author: Aidan Garske <aidan at wolfssl.com>
+ */
+
+#define LOG_CATEGORY UCLASS_BOOTSTD
+
+#include <wolftpm.h>
+#include <wolftpm/tpm2.h>
+#include <wolftpm/tpm2_wrap.h>
+#include <wolftpm/tpm2_packet.h>
+#include <hal/tpm_io.h>
+#include <stdio.h>
+#include <string.h>
+#include <log.h>
+#include <hash.h>
+#include <examples/wrap/wrap_test.h>
+
+#ifndef WOLFTPM2_NO_WRAPPER
+#ifdef WOLFTPM_FIRMWARE_UPGRADE
+
+/******************************************************************************/
+/* --- BEGIN helper functions -- */
+/******************************************************************************/
+
+struct fw_info {
+ byte *manifest_buf;
+ byte *firmware_buf;
+ size_t manifest_bufSz;
+ size_t firmware_bufSz;
+};
+
+int TPM2_IFX_FwData_Cb(uint8_t *data, uint32_t data_req_sz,
+ uint32_t offset, void *cb_ctx)
+{
+ struct fw_info *fwinfo = (struct fw_info *)cb_ctx;
+
+ if (offset > fwinfo->firmware_bufSz)
+ return BUFFER_E;
+ if (offset + data_req_sz > (uint32_t)fwinfo->firmware_bufSz)
+ data_req_sz = (uint32_t)fwinfo->firmware_bufSz - offset;
+ if (data_req_sz > 0)
+ memcpy(data, &fwinfo->firmware_buf[offset], data_req_sz);
+ return data_req_sz;
+}
+
+const char *TPM2_IFX_GetOpModeStr(int opMode)
+{
+ const char *opModeStr = "Unknown";
+
+ switch (opMode) {
+ case 0x00:
+ opModeStr = "Normal TPM operational mode";
+ break;
+ case 0x01:
+ opModeStr = "TPM firmware update mode (abandon possible)";
+ break;
+ case 0x02:
+ opModeStr = "TPM firmware update mode (abandon not possible)";
+ break;
+ case 0x03:
+ opModeStr = "After successful update, but before finalize";
+ break;
+ case 0x04:
+ opModeStr = "After finalize or abandon, reboot required";
+ break;
+ default:
+ break;
+ }
+ return opModeStr;
+}
+
+void TPM2_IFX_PrintInfo(WOLFTPM2_CAPS *caps)
+{
+ printf("Mfg %s (%d), Vendor %s, Fw %u.%u (0x%x)\n",
+ caps->mfgStr, caps->mfg, caps->vendorStr, caps->fwVerMajor,
+ caps->fwVerMinor, caps->fwVerVendor);
+ printf("Operational mode: %s (0x%x)\n",
+ TPM2_IFX_GetOpModeStr(caps->opMode), caps->opMode);
+ printf("KeyGroupId 0x%x, FwCounter %d (%d same)\n",
+ caps->keyGroupId, caps->fwCounter, caps->fwCounterSame);
+}
+#endif /* WOLFTPM_FIRMWARE_UPGRADE */
+
+int TPM2_PCRs_Print(void)
+{
+ int rc;
+ int pcrCount, pcrIndex;
+ GetCapability_In capIn;
+ GetCapability_Out capOut;
+ TPML_PCR_SELECTION *pcrSel;
+
+ memset(&capIn, 0, sizeof(capIn));
+ capIn.capability = TPM_CAP_PCRS;
+ capIn.property = 0;
+ capIn.propertyCount = 1;
+ rc = TPM2_GetCapability(&capIn, &capOut);
+ if (rc != TPM_RC_SUCCESS) {
+ log_debug("TPM2_GetCapability failed rc=%d (%s)\n",
+ rc, TPM2_GetRCString(rc));
+ return rc;
+ }
+ pcrSel = &capOut.capabilityData.data.assignedPCR;
+ printf("Assigned PCR's:\n");
+ for (pcrCount = 0; pcrCount < (int)pcrSel->count; pcrCount++) {
+ printf("\t%s: ",
+ TPM2_GetAlgName(pcrSel->pcrSelections[pcrCount].hash));
+ for (pcrIndex = 0;
+ pcrIndex < pcrSel->pcrSelections[pcrCount].sizeofSelect * 8;
+ pcrIndex++) {
+ if ((pcrSel->pcrSelections[pcrCount].pcrSelect[pcrIndex / 8] &
+ ((1 << (pcrIndex % 8)))) != 0)
+ printf(" %d", pcrIndex);
+ }
+ printf("\n");
+ }
+ return TPM_RC_SUCCESS;
+}
+
+int TPM2_Init_Device(WOLFTPM2_DEV *dev, void *userCtx)
+{
+ int rc;
+
+ /* Use TPM2_IoCb callback for packet-level access */
+ rc = wolfTPM2_Init(dev, TPM2_IoCb, userCtx);
+ log_debug("tpm2 init: rc = %d (%s)\n", rc, TPM2_GetRCString(rc));
+ return rc;
+}
+
+#endif /* WOLFTPM2_NO_WRAPPER */
+
+/******************************************************************************/
+/* --- END helper functions -- */
+/******************************************************************************/
--
2.43.0
More information about the U-Boot
mailing list