Harden fwTPM protocol handling and SPDM authentication

[aidangarske]

F-12708, F-12709, F-12710, F-12735, F-12736, F-12738

[Copilot]

🔵 Needs a closer look

It changes multiple security-sensitive transport and authentication paths (SPDM credentialing + fwTPM TIS endpoint validation) across core code, tests, and build systems, warranting careful human validation beyond automated review.

Pull request overview

This PR hardens wolfTPM’s fwTPM (POSIX TIS shared-memory transport) and SPDM integration by tightening endpoint authentication/validation and by requiring explicit SPDM credentials (pinned responder key or PSK) for SPDM-only devices, reducing exposure to bus/transport spoofing and state-confusion.

Changes:

• Add credentialed wrapper init paths for SPDM-only TPMs (pinned responder key and PSK), plus responder-key pinning APIs and stricter identity-mode preconditions.
• Harden fwTPM POSIX TIS transport by validating shared-memory endpoint metadata, namespacing semaphore names per-UID, and adding atomic “magic” publication/consumption to avoid torn header reads.
• Extend fwTPM command handling and tests (ECC curve capabilities/parameters incl. P-521 gating, ordered handle paging, ReadClock counters, stricter length checks for sequence completion, regression coverage for TPM_RC_UPGRADE init flow).

File summaries

File	Description
wolftpm/tpm2_wrap.h	Documents and exposes new SPDM-credentialed init APIs and responder key pinning.
wolftpm/spdm/spdm.h	Adds AUTO mode and clarifies responder key pinning requirement for identity connections.
wolftpm/spdm/spdm_tcg.h	Documents GET_PUBK as cleartext discovery and non-trust source.
wolftpm/fwtpm/fwtpm.h	Adds FWTPM_HAVE_ECC521 gating based on wolfCrypt + TPM field sizing.
wolftpm/fwtpm/fwtpm_tis.h	Bumps TIS protocol version and introduces semaphore-name sizing and helper prototype.
src/tpm2.c	Initializes Linux fd earlier and adds NULL active-ctx guard in ST33 upgrade command path.
src/tpm2_wrap.c	Implements SPDM credentialed init flows, fail-closed behavior for SPDM-only without creds, and responder key pinning wrapper.
src/spdm/spdm_crypto.c	Adds reusable ECC point extraction helper and uses it for signature verification.
src/spdm/spdm_tcg.c	Enforces pinned-key requirement for identity connections; computes Ct from verified GET_PUBK object.
src/spdm/spdm_context.c	Makes NULL-mode default explicit as AUTO.
src/spdm/spdm_internal.h	Clarifies responder key storage as pinned raw X||Y and exposes test helper.
hal/tpm_io_fwtpm.c	Hardens client connect: endpoint metadata validation, inode checks, per-UID semaphore derivation, atomic magic acquire.
src/fwtpm/fwtpm_tis.c	Publishes shared-memory magic with release semantics after fully initializing header state.
src/fwtpm/fwtpm_tis_shm.c	Hardens server endpoint creation, derives per-UID semaphore names, and unlinks safely; atomic invalidation on cleanup.
src/fwtpm/fwtpm_tis_sem.c	New shared helper for deterministic per-UID semaphore-name derivation.
src/fwtpm/fwtpm_command.c	Adds ECC_CURVES capability, ordered handle paging, ReadClock counters, robust hex decode/padding for ECC params, and stricter buffer bounds checks.
src/fwtpm/fwtpm_crypto.c	Tightens curve availability checks; bounds key size; gates P-521 support consistently.
examples/spdm/spdm_ctrl.c	Adds responder-key/PSK CLI plumbing, caps command, and stricter vendor/argument validation.
examples/spdm/spdm_test.sh	Updates test flows to require pinned keys for identity mode; adds negative tests and fwTPM bootstrap behavior.
src/fwtpm/fwtpm_main.c	Emits responder public key in TCG test mode for local harness bootstrap; flushes output.
src/spdm/unit_test.c	Adds unit coverage for ECC point extraction, pinned-key behavior, and identity-mode loopback roundtrip.
tests/unit_tests.c	Routes wrapper tests through credentialed init when configured; adds upgrade-context regression and SPDM pin/PSK tests.
tests/fwtpm_unit_tests.c	Adds capability paging tests (ECC curves, ordered handles), ReadClock counter tests, ECC param hex decode test, and truncated buffer rejection.
tests/include.am / src/include.am / src/fwtpm/include.am / src/spdm/include.am	Updates build/link plumbing for new TIS libs and unit tests.
configure.ac / CMakeLists.txt / cmake/wolftpm-config.cmake.in / tests/cmake_static_consumer/CMakeLists.txt	Adds platform link discovery for sem_open and improves installed CMake package/export behavior.
docs/FWTPM.md / src/spdm/README.md / src/fwtpm/README.md / examples/spdm/README.md	Updates documentation to reflect pinned-key requirements and new transport semantics.
.github/workflows/*	Expands CI matrices for SPDM modes and fwTPM TIS/pedantic coverage; adds static consumer check.

Review details

• Files reviewed: 41/41 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.