From 4ae80c56dd8f60eba879ef0d7e836a5bb3a825b4 Mon Sep 17 00:00:00 2001 From: David Garske Date: Mon, 31 Aug 2026 10:26:12 -0700 Subject: [PATCH] Fix vendor string capability accumulation --- README.md | 5 +++-- examples/firmware/README.md | 3 +-- src/tpm2_wrap.c | 5 ++++- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 7e57174e..b5082016 100644 --- a/README.md +++ b/README.md @@ -279,8 +279,9 @@ Microchip ATTPM20 TPM2: Caps 0x30000695, Did 0x3205, Vid 0x1114, Rid 0x 1 Mfg MCHP (3), Vendor , Fw 512.20481 (0), FIPS 140-2 0, CC-EAL4 0 -Note: ST33TPHF2X parts report `TPM_PT_VENDOR_STRING_1..4` as zero or as -non-printable bytes, so the `Vendor` field prints empty. The firmware major version identifies the line +Note: early ST33TPHF2X 1.x firmware reports `TPM_PT_VENDOR_STRING_1..4` as +binary rather than text, so the `Vendor` field prints empty; later 1.x firmware +reports ASCII such as `ST33TPHF2XSPI`. The firmware major version identifies the line instead: 1.x and 2.x are ST33TPHF2X (SPI and I2C firmware respectively), 9.x is ST33KTPM2X and 10.x is ST33KTPM2A. See [examples/firmware/README.md](examples/firmware/README.md) for how this selects diff --git a/examples/firmware/README.md b/examples/firmware/README.md index 73766fd3..db192ea5 100644 --- a/examples/firmware/README.md +++ b/examples/firmware/README.md @@ -133,7 +133,7 @@ The LMS requirement is a generation 9 rule, so both `fwVerMajor` and `fwVerMinor ### Identifying the part -ST33TPHF2X parts report `TPM_PT_VENDOR_STRING_1..4` as zero or as non-printable bytes, so unlike an ST33KTPM they print an empty `Vendor` field. `st33_fw_update` dumps the raw bytes so they can still be compared. What identifies them is the firmware major version, which tracks the part and interface line: +What `TPM_PT_VENDOR_STRING_1..4` reports on an ST33TPHF2X depends on the firmware. Early 1.x firmware reports binary rather than text, so the `Vendor` field prints empty; later 1.x firmware reports ASCII, for example `ST33TPHF2XSPI`. The change is present by firmware 1.771 and absent at 1.258; which firmware introduced it is not known. The firmware major version is the reliable identifier either way, and it tracks the part and interface line: | `fwVerMajor` | Part line | Example firmware image | | --- | --- | --- | @@ -204,7 +204,6 @@ ST33 Firmware Update Tool TPM2: Caps 0x30000415, Did 0x0000, Vid 0x104a, Rid 0x4e TPM2_Startup pass Mfg STM (2), Vendor , Fw 1.258 (0x0) -Vendor string bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Firmware version details: Major=1, Minor=258, Vendor=0x0 Part line: ST33TPHF2X (SPI firmware line) Firmware generation: 1 diff --git a/src/tpm2_wrap.c b/src/tpm2_wrap.c index bf2a065a..3a8f089a 100644 --- a/src/tpm2_wrap.c +++ b/src/tpm2_wrap.c @@ -886,7 +886,10 @@ static int wolfTPM2_ParseCapabilities(WOLFTPM2_CAPS* caps, case TPM_PT_VENDOR_STRING_3: case TPM_PT_VENDOR_STRING_4: val = TPM2_Packet_SwapU32(val); /* swap for little endian */ - len = (word32)XSTRLEN(caps->vendorStr); /* add to existing string */ + /* Offset by property, not string length: a chunk starting + * with a zero byte would let the next one overwrite it */ + len = (word32)(props->tpmProperty[i].property - + TPM_PT_VENDOR_STRING_1) * (word32)sizeof(UINT32); if (len + sizeof(UINT32) < sizeof(caps->vendorStr)) { XMEMCPY(&caps->vendorStr[len], &val, sizeof(UINT32)); }