Infineon OPTIGA SLB9678 support over the TCG SPDM binding

[dgarske]

Description

Adds support for the Infineon OPTIGA SLB9678 TPM 2.0 over the Trusted Computing Group (TCG) Security Protocol and Data Model (SPDM) binding, in which the TPM authenticates with a provisioned public key rather than a certificate chain. The SLB9678 vendor commands themselves live in wolfSPDM.

What it adds

• --enable-infineon[=slb9673|slb9678], implying --enable-tcg
• wolfTPM2_InitWithSpdmKey_ex, taking the protocol mode so a part with no vendor commands of its own can select the plain TCG binding
• identity connect paths in tpm2_wrap.c, plus Infineon pre-shared key (PSK) provisioning and SPDM-only locking helpers
• TPM2_SetCapability and TPM_CAP_CONFIGS parsing, how the part's SPDM configuration is read, enabled and locked
• examples/spdm/spdm_ctrl subcommands for status, enabling, PSK provisioning and the SPDM-only transition
• lib/wolfSPDM advanced to the commit carrying the SLB9678 vendor commands

Touches shared code

• src/tpm2_packet.c - a required HMAC authorization was not counted in the authorization area, and its size came from the authorization key rather than the session hash. Both are wrong for any HMAC session, not only the SPDM ones.

Testing

Validated on a PSOC Control C3 (C3M6) EVK driving an SLB9678 on mikroBUS: handshake against a pinned responder key, a TPM command inside the encrypted session, clean close. src/spdm/unit_test and the three new test binaries pass.

[Copilot]

🟡 Changes recommended

Capability parsing accepts malformed responses, and Infineon status and PSK provisioning paths mishandle errors or protocol mode.

4 open findings

• Return capability failures to the caller · New
• Set Infineon PSK mode before provisioning · New
• Set Infineon PSK mode before clearing · New
• Reject malformed TPM_CAP_CONFIGS responses · New

What changed in this PR

Adds Infineon OPTIGA SLB9678 support across configuration, SPDM transport, TPM capability handling, tooling, tests, and documentation.

Changes:

• Adds SLB9678 TCG asymmetric and optional PSK workflows.
• Implements TPM2_SetCapability, configuration parsing, and HMAC authorization fixes.
• Extends SPDM control tools, tests, build integration, and documentation.

File	Description
wolftpm/​tpm2.h	Adds configuration capability types and command API.
wolftpm/​tpm2_wrap.h	Exposes Infineon SPDM wrapper APIs.
wolftpm/​tpm2_types.h	Defines SLB9678 capabilities and firmware guards.
wolftpm/​tpm2_spdm.h	Clarifies transport callback behavior.
wolftpm/​spdm/​spdm_infineon.h	Adds the wolfSPDM forwarding header.
wolftpm/​include.am	Installs Infineon SPDM headers.
tests/​unit_tests.c	Extends SPDM mode and argument tests.
tests/​spdm_ctrl_tests.c	Adds control-command regression tests.
tests/​spdm_config_tests.c	Tests capability encoding, parsing, and authorization.
tests/​packet_auth_tests.c	Tests HMAC authorization accounting.
tests/​include.am	Registers the new test programs.
src/​tpm2.c	Implements configuration capability parsing and setting.
src/​tpm2_wrap.c	Adds shared identity and Infineon SPDM flows.
src/​tpm2_spdm.c	Supports plain TCG mode and custom I/O retention.
src/​tpm2_packet.c	Corrects HMAC authorization count and sizing.
src/​spdm/​include.am	Builds the Infineon wolfSPDM adapter.
README.md	Documents SLB9678 build and transport support.
examples/​wrap/​wrap_test.c	Uses the shared Infineon firmware guard.
examples/​wrap/​caps.c	Uses the shared Infineon firmware guard.
examples/​spdm/​spdm_test.sh	Adds SLB9678 hardware test flows.
examples/​spdm/​spdm_ctrl.c	Adds SLB9678 configuration and provisioning commands.
examples/​spdm/​README.md	Documents SLB9678 SPDM operation.
examples/​firmware/​ifx_fw_update.c	Enables SLB9678 firmware tooling.
configure.ac	Adds SLB9678 and Infineon SPDM configuration.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Shared authentication and hardware security flows need human validation, and a vendor-free test build regression remains unresolved.

1 open finding

• Define mock_connected for vendor-free TCG+PSK builds · New

4 resolved since last review

• Reject malformed TPM_CAP_CONFIGS responses
• Set Infineon PSK mode before clearing
• Set Infineon PSK mode before provisioning
• Return capability failures to the caller

🧠 Review effort: Balanced

[aidangarske]

Skoll Code Review

Scan type: review

Overall recommendation: COMMENT
Findings: 5 total — 5 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)
1 finding(s) not tied to a diff line (full detail below)

Posted findings

• [Medium] Document the newly supported generic TCG initialization path — wolftpm/tpm2_wrap.h:262-309
• [Medium] Define and validate the PSK provisioning payload contract — src/tpm2_wrap.c:1825-1845
• [Medium] Exercise malformed TPM_CAP_CONFIGS responses — tests/spdm_config_tests.c:132-186
• [Medium] Add automated coverage for a successful generic TCG connection — scripts/ci/spdm.sh:55-61

Findings not tied to a diff line

Add the advertised wolfSPDM Infineon PSK alias

File: lib/wolfSPDM/wolfspdm/spdm_infineon.h:87
Function: wolfSPDM_ConnectInfineonPsk

The new Infineon header and implementation both state that wolfSPDM_ConnectInfineonPsk is a compatibility alias declared in spdm_psk.h, but that header only defines wolfSPDM_ConnectNationsPsk. Code using the advertised Infineon name therefore fails to compile.

Recommendation: Define wolfSPDM_ConnectInfineonPsk as an alias for wolfSPDM_ConnectPsk inside the WOLFSPDM_PSK section of spdm_psk.h, or remove the compatibility claim if the alias is not intended.

Referenced code: lib/wolfSPDM/wolfspdm/spdm_infineon.h:87-90 (4 lines)

---

Review generated by Skoll