[dgarske]

Description

Adds --enable-pikeos (CMake WOLFTPM_INTERFACE=PIKEOS) for PikeOS, where the TPM driver is reached through the file provider (vm_open/vm_write/vm_read) and takes whole TPM commands, like the Linux /dev/tpm0 transport.

• src/tpm2_pikeos.c, wolftpm/tpm2_pikeos.h: the transport. The device defaults to tpm0:dev0; override with TPM2_PIKEOS_DEV.
• No TIS layer: TPM2_IoCb is NULL and the driver owns locality. wolfTPM still sends TPM2_Startup.
• wolftpm/tpm2_types.h, examples/tpm_test.h: sleep and time helpers using p4_sleep/p4_get_time.
• tests/pikeos_unit_tests.c, tests/pikeos_stub/: host test of the transport against stubbed vm_* calls, covering dispatch, I/O failures, response bounds, retries and cleanup. CI builds and runs it.
• TPM2_Init_ex rejects a positive timeoutTries, as there is no TIS layer to wait on, and selecting PikeOS excludes the Linux autodetect transport.
• TPM2_Cleanup returns TPM_RC_FAILURE when the driver file fails to close, and wolfTPM2_Cleanup passes it on. Configure rejects --enable-pikeos together with --enable-winapi/--enable-wintbs or --enable-hal-reset.

Testing

Cross-compiled with the PikeOS 5.1 x86_64 SDK. Tested on a PikeOS target with an Infineon SLB9670 behind the PikeOS TPM driver: caps and wrap_test pass.

[Copilot]

🟡 Changes recommended

Truncated PikeOS TPM responses can pass validation and return stale buffer contents as randomness, while cleanup can leak device descriptors for inactive contexts.

2 open issues

• Truncated responses can expose stale bytes as random data · New
• PikeOS descriptor leaks when cleaning up an inactive context · New

What changed in this PR

Adds PikeOS as a whole-command TPM transport, integrating its file-provider driver into wolfTPM without a TIS callback.

Changes:

• Adds device I/O and cleanup through PikeOS vm_* APIs.
• Integrates transport selection, driver-owned locality, and PikeOS timing helpers.
• Adds build options, usage documentation, and compile-only CI with SDK stubs.

File	Description
wolftpm/​tpm2.h	Adds per-context PikeOS device state.
wolftpm/​tpm2_types.h	Adds PikeOS timeout and timing helpers.
wolftpm/​tpm2_pikeos.h	Declares transport and cleanup functions.
wolftpm/​include.am	Includes the PikeOS header in installation.
src/​tpm2.c	Connects PikeOS dispatch, cleanup, and initialization.
src/​tpm2_wrap.c	Adapts initialization, locality, and firmware-update paths.
src/​tpm2_spdm.c	Excludes PikeOS from TIS-based SPDM I/O.
src/​tpm2_pikeos.c	Implements file-provider command transport.
src/​include.am	Adds the transport to Autotools sources.
hal/​tpm_io.h	Defines a null I/O callback for PikeOS.
hal/​tpm_io.c	Excludes callback implementation for PikeOS.
examples/​tpm_test.h	Adds PikeOS example timing support.
docs/​hal-io-callback.md	Lists PikeOS as a system interface.
docs/​getting-started.md	Documents PikeOS disabling software-backend defaults.
docs/​build-options.md	Documents configuration and runtime prerequisites.
configure.ac	Adds PikeOS selection and compatibility checks.
CMakeLists.txt	Adds the PIKEOS interface option and source.
.github/​workflows/​pikeos-build.yml	Adds normal and debug compile checks using SDK stubs.

_{Review effort: Balanced}

[embhorn]

Skoll Code Review

Scan type: review

Overall recommendation: REQUEST_CHANGES
Findings: 3 total — 3 posted, 0 skipped
3 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [High] Default autodetect overrides PikeOS on Linux builds — src/tpm2.c:84-88
• [High] Positive init timeout enters TIS with a null callback — src/tpm2.c:1078-1080
• [Medium] Transport behavior has no automated runtime test — .github/workflows/pikeos-build.yml:62-75

Review generated by Skoll

[embhorn]

Skoll Code Review

Scan type: review

Overall recommendation: REQUEST_CHANGES
Findings: 3 total — 3 posted, 0 skipped
3 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [High] PikeOS close failures are hidden from callers — src/tpm2.c:1253-1255
• [Medium] PikeOS accepts an unavailable HAL reset option — hal/tpm_io.c:49-50
• [Medium] PikeOS and Windows TBS can be selected together — configure.ac:258-263

Review generated by Skoll