WolfSSL
/
wolfTPM
mirror of https://github.com/wolfSSL/wolfTPM.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-12736 - Authenticate fwTPM shared-memory endpoints

pull/588/head
Aidan Garske 2026-08-31 12:44:18 -07:00
parent 5e3cbd2241
commit 95696b36ef
18 changed files with 1025 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
.github/workflows/cmake-build.yml vendored
View File

@ -212,11 +212,9 @@ jobs:
fi
# Verify that a static-library build can be installed and its exported
# CMake targets are self-consistent. The matrix builds above use
# WITH_WOLFSSL (shared library) and do not catch this because CMake only
# enforces export-set completeness for static libraries: any CMake target
# in a static library's PRIVATE link chain must be exported or wrapped in
# $<BUILD_INTERFACE:...>.
# CMake targets are self-consistent. The TIS build also verifies that an
# installed package resolves imported static-link dependencies before its
# exported target is loaded by a downstream project.
cmake-static-export:
name: CMake static export check
if: github.event_name != 'pull_request' || github.event.pull_request.draft == false
@ -269,10 +267,19 @@ jobs:
cmake \
-DBUILD_SHARED_LIBS=OFF \
-DWOLFTPM_EXAMPLES=no \
-DWOLFTPM_FWTPM=no \
-DWOLFTPM_FWTPM=yes \
-DWOLFTPM_INTERFACE=SPI \
-DWOLFTPM_BUILD_OUT_OF_TREE=yes \
-DCMAKE_C_FLAGS="-DWOLFSSL_AES_CFB -DWOLFSSL_PUBLIC_MP" \
-DCMAKE_PREFIX_PATH="$GITHUB_WORKSPACE/install" \
-DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/install" \
..
cmake --build . --parallel
cmake --install .
- name: Configure installed static consumer
run: |
cmake \
-S tests/cmake_static_consumer \
-B build-static-consumer \
-DCMAKE_PREFIX_PATH="$GITHUB_WORKSPACE/install"

11
.github/workflows/fwtpm-test.yml vendored
View File

@ -34,7 +34,7 @@ jobs:
# fwTPM with TIS/shared-memory transport
- name: fwtpm-tis
os: ubuntu-latest
wolftpm_config: --enable-fwtpm --enable-debug
wolftpm_config: --enable-fwtpm --disable-swtpm --enable-debug
wolfssl_config: --enable-wolftpm --enable-pkcallbacks --enable-keygen
build_only: false
@ -254,6 +254,15 @@ jobs:
cc: clang
make_cflags: "-Wall -Wextra -Wpedantic -Werror -Wshadow -Wstrict-prototypes -Wmissing-prototypes -Wformat=2"
# Build-only: pedantic warnings on the POSIX TIS transport and its
# dedicated HAL/semaphore tests.
- name: fwtpm-pedantic-tis
os: ubuntu-latest
wolftpm_config: --enable-fwtpm --disable-swtpm
wolfssl_config: --enable-wolftpm --enable-pkcallbacks --enable-keygen
build_only: true
make_cflags: "-Wall -Wextra -Wpedantic -Werror -Wshadow -Wstrict-prototypes -Wmissing-prototypes -Wformat=2"
# Build-only: pedantic fwTPM-only (no client library)
- name: fwtpm-pedantic-only
os: ubuntu-latest

97
CMakeLists.txt
View File

@ -404,6 +404,30 @@ if(WOLFTPM_FWTPM_ONLY)
list(APPEND WOLFTPM_DEFINITIONS "-DWOLFTPM2_NO_WRAPPER")
endif()
set(WOLFTPM_FWTPM_THREAD_LIBS)
set(WOLFTPM_FWTPM_TIS_LIBS)
if(WOLFTPM_FWTPM AND UNIX)
find_package(Threads REQUIRED)
list(APPEND WOLFTPM_FWTPM_THREAD_LIBS Threads::Threads)
if(WOLFTPM_FWTPM_TIS)
set(WOLFTPM_FWTPM_TIS_LIBS ${WOLFTPM_FWTPM_THREAD_LIBS})
if(NOT APPLE)
include(CheckLibraryExists)
check_library_exists(rt sem_open "" WOLFTPM_FWTPM_HAVE_LIBRT)
if(WOLFTPM_FWTPM_HAVE_LIBRT)
list(APPEND WOLFTPM_FWTPM_TIS_LIBS rt)
endif()
endif()
endif()
endif()
if(WOLFTPM_FWTPM_TIS AND BUILD_WOLFTPM_LIB)
target_sources(wolftpm PRIVATE src/fwtpm/fwtpm_tis_sem.c)
if(UNIX)
target_link_libraries(wolftpm PRIVATE ${WOLFTPM_FWTPM_TIS_LIBS})
endif()
endif()
# Examples
set(WOLFTPM_EXAMPLES "yes" CACHE BOOL
"Build examples")
@ -522,6 +546,7 @@ if(WOLFTPM_FWTPM)
if(WOLFTPM_FWTPM_TIS)
list(APPEND FWTPM_SERVER_SOURCES
src/fwtpm/fwtpm_tis.c
src/fwtpm/fwtpm_tis_sem.c
src/fwtpm/fwtpm_tis_shm.c
)
endif()
@ -541,9 +566,12 @@ if(WOLFTPM_FWTPM)
${CMAKE_CURRENT_BINARY_DIR}
)
if(UNIX)
target_link_libraries(fwtpm_server PRIVATE pthread)
if(NOT APPLE)
target_link_libraries(fwtpm_server PRIVATE rt)
if(WOLFTPM_FWTPM_TIS)
target_link_libraries(fwtpm_server PRIVATE
${WOLFTPM_FWTPM_TIS_LIBS})
else()
target_link_libraries(fwtpm_server PRIVATE
${WOLFTPM_FWTPM_THREAD_LIBS})
endif()
elseif(WIN32)
target_link_libraries(fwtpm_server PRIVATE ws2_32)
@ -568,7 +596,43 @@ if(WOLFTPM_FWTPM)
${CMAKE_CURRENT_BINARY_DIR}
)
if(UNIX)
target_link_libraries(fwtpm_unit_test PRIVATE pthread)
target_link_libraries(fwtpm_unit_test PRIVATE
${WOLFTPM_FWTPM_THREAD_LIBS})
endif()
if(WOLFTPM_FWTPM_TIS)
add_executable(fwtpm_hal_unit_test
tests/fwtpm_hal_unit_tests.c
)
target_compile_definitions(fwtpm_hal_unit_test PRIVATE
"WOLFTPM_FWTPM_HAL"
"WOLFTPM_ADV_IO"
"WOLFTPM_EXAMPLE_HAL"
)
target_link_libraries(fwtpm_hal_unit_test PRIVATE wolftpm_wolfssl_dep)
target_include_directories(fwtpm_hal_unit_test PRIVATE
${CMAKE_CURRENT_SOURCE_DIR}
${CMAKE_CURRENT_BINARY_DIR}
)
if(UNIX)
target_link_libraries(fwtpm_hal_unit_test PRIVATE
${WOLFTPM_FWTPM_TIS_LIBS})
endif()
add_executable(fwtpm_tis_sem_unit_test
tests/fwtpm_tis_sem_unit_tests.c
src/fwtpm/fwtpm_tis_sem.c
)
target_compile_definitions(fwtpm_tis_sem_unit_test PRIVATE
"WOLFTPM_FWTPM_TIS"
)
target_link_libraries(fwtpm_tis_sem_unit_test PRIVATE
wolftpm_wolfssl_dep
)
target_include_directories(fwtpm_tis_sem_unit_test PRIVATE
${CMAKE_CURRENT_SOURCE_DIR}
${CMAKE_CURRENT_BINARY_DIR}
)
endif()
# fwTPM fuzz target (libFuzzer)
@ -596,6 +660,16 @@ if(WOLFTPM_FWTPM)
COMMAND fwtpm_unit_test
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
)
if(WOLFTPM_FWTPM_TIS)
add_test(NAME fwtpm_hal_unit_test
COMMAND fwtpm_hal_unit_test
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
)
add_test(NAME fwtpm_tis_sem_unit_test
COMMAND fwtpm_tis_sem_unit_test
WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
)
endif()
message(STATUS "fwTPM server: enabled")
if(WOLFTPM_FWTPM_TIS)
@ -765,6 +839,17 @@ endif()
include(GNUInstallDirs)
if(BUILD_WOLFTPM_LIB)
include(CMakePackageConfigHelpers)
set(WOLFTPM_CONFIG_NEEDS_THREADS OFF)
if(WOLFTPM_FWTPM_TIS AND UNIX)
set(WOLFTPM_CONFIG_NEEDS_THREADS ON)
endif()
configure_package_config_file(
"${CMAKE_CURRENT_SOURCE_DIR}/cmake/wolftpm-config.cmake.in"
"${CMAKE_CURRENT_BINARY_DIR}/wolftpm-config.cmake"
INSTALL_DESTINATION "${CMAKE_INSTALL_LIBDIR}/cmake/wolftpm"
)
# Note: wolftpm_wolfssl_dep is an INTERFACE helper used only at build
# time to share wolfSSL include/link settings. It is intentionally NOT
# installed/exported — downstream `find_package(wolftpm)` should only
@ -779,8 +864,10 @@ if(BUILD_WOLFTPM_LIB)
# Install the export set
install(EXPORT wolftpm-targets
DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/wolftpm
FILE wolftpm-config.cmake
FILE wolftpm-targets.cmake
NAMESPACE wolfssl::)
install(FILES "${CMAKE_CURRENT_BINARY_DIR}/wolftpm-config.cmake"
DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/wolftpm)
endif()
# Install fwTPM server

8
cmake/wolftpm-config.cmake.in 100644
View File

@ -0,0 +1,8 @@
@PACKAGE_INIT@
include(CMakeFindDependencyMacro)
if(@WOLFTPM_CONFIG_NEEDS_THREADS@)
find_dependency(Threads)
endif()
include("${CMAKE_CURRENT_LIST_DIR}/wolftpm-targets.cmake")

19
configure.ac
View File

@ -424,6 +424,25 @@ then
fi
fi
# POSIX TIS/shared-memory consumers need the platform's semaphore link flags.
# Keep these target-scoped instead of adding them to LIBS.
FWTPM_TIS_LIBS=""
if test "x$ENABLED_FWTPM_TIS" = "xyes"
then
fwtpm_tis_saved_LIBS="$LIBS"
LIBS="$PTHREAD_LIBS $LIBS"
AC_SEARCH_LIBS([sem_open], [rt pthread], [
AS_IF([test "x$ac_cv_search_sem_open" != "xnone required"], [
FWTPM_TIS_LIBS="$FWTPM_TIS_LIBS $ac_cv_search_sem_open"
])
], [
AC_MSG_ERROR([fwTPM TIS transport requires POSIX sem_open])
])
LIBS="$fwtpm_tis_saved_LIBS"
FWTPM_TIS_LIBS="$PTHREAD_LIBS $FWTPM_TIS_LIBS"
fi
AC_SUBST([FWTPM_TIS_LIBS])
# Append-only NV journal for write-once flash fwTPM ports (opt-in)
AC_ARG_ENABLE([fwtpm-nv-appendonly],
[AS_HELP_STRING([--enable-fwtpm-nv-appendonly],[Enable the append-only NV journal mode for write-once flash fwTPM ports (default: disabled)])],

19
docs/FWTPM.md
View File

@ -45,6 +45,7 @@ fwTPM can replace a hardware TPM for:
| `fwtpm_io.c` | Transport layer -- SWTPM TCP socket protocol (default) |
| `fwtpm_nv.c` | NV storage -- file-based (default); HAL-abstracted, with a built-in append-only mode for write-once flash |
| `fwtpm_tis.c` | TIS register state machine (transport-agnostic) |
| `fwtpm_tis_sem.c` | POSIX semaphore-name derivation shared by server and client HAL |
| `fwtpm_tis_shm.c` | POSIX shared memory + semaphore TIS transport |
| `fwtpm_main.c` | Server entry point, CLI argument parsing |
| `tpm2_util.c` | Shared utilities (hash helpers, ForceZero, PrintBin) |
@ -754,7 +755,7 @@ register-level access. This mode simulates an SPI-attached TPM.
| Field | Description |
|-------|-------------|
| `magic` / `version` | Validation header (`0x57544953` / `"WTIS"`) |
| `magic` / `version` | Validation header (`0x57544953` / `"WTIS"`, protocol version 2) |
| `reg_addr`, `reg_len`, `reg_is_write`, `reg_data` | Register access request |
| TIS register shadow: `access`, `sts`, `int_enable`, `int_status`, `intf_caps`, `did_vid`, `rid` | Emulated TIS registers |
| `cmd_buf[4096]`, `cmd_len`, `fifo_write_pos` | Command FIFO |
@ -764,9 +765,19 @@ register-level access. This mode simulates an SPI-attached TPM.
| Define | Default | Description |
|--------|---------|-------------|
| `FWTPM_TIS_SHM_PATH` | `/tmp/fwtpm.shm` | Shared memory file |
| `FWTPM_TIS_SEM_CMD` | `/fwtpm_cmd` | Command semaphore name |
| `FWTPM_TIS_SEM_RSP` | `/fwtpm_rsp` | Response semaphore name |
| `FWTPM_TIS_SHM_PATH` | `/tmp/fwtpm.shm` | Shared memory file; clients require a regular, single-link, same-UID, exact-size `0600` endpoint |
| `FWTPM_TIS_SEM_CMD` | `/fwtpm_cmd` | Command semaphore prefix; a per-UID suffix is always appended |
| `FWTPM_TIS_SEM_RSP` | `/fwtpm_rsp` | Response semaphore prefix; a per-UID suffix is always appended |
Protocol version 2 requires an exact version and shared-region-size match.
Rebuild the client library and `fwtpm_server` together when upgrading or when
changing options that affect `FWTPM_TIS_FIFO_SIZE`; version 1 and version 2
peers do not interoperate.
The default shared-memory path is global, so it supports one server per host.
The per-UID semaphore suffix enables safe stale-object cleanup; it does not
enable concurrent per-user servers unless each build also uses a distinct
`FWTPM_TIS_SHM_PATH`.
**Server-side API:**

136
hal/tpm_io_fwtpm.c
View File

@ -79,23 +79,48 @@ static void FWTPM_TIS_ClientUnlock(int fd)
} while (rc != 0 && errno == EINTR);
}
static int FWTPM_TIS_ServerActive(const FWTPM_TIS_REGS* shm)
static UINT32 FWTPM_TIS_LoadMagic(const FWTPM_TIS_REGS* shm)
{
#if defined(__GNUC__) || defined(__clang__)
return __atomic_load_n(&shm->magic, __ATOMIC_ACQUIRE);
#else
const volatile UINT32* magic = &shm->magic;
return *magic == FWTPM_TIS_MAGIC;
return *magic;
#endif
}
static int FWTPM_TIS_ServerActive(const FWTPM_TIS_REGS* shm)
{
return FWTPM_TIS_LoadMagic(shm) == FWTPM_TIS_MAGIC;
}
static int FWTPM_TIS_ClientValidateShm(const struct stat* st)
{
mode_t expectedMode = S_IRUSR | S_IWUSR;
if (!S_ISREG(st->st_mode) || st->st_uid != geteuid() ||
st->st_nlink != 1 ||
(st->st_mode & (S_IRWXU | S_IRWXG | S_IRWXO)) != expectedMode ||
st->st_size != (off_t)sizeof(FWTPM_TIS_REGS)) {
return TPM_RC_FAILURE;
}
return TPM_RC_SUCCESS;
}
int FWTPM_TIS_ClientConnect(FWTPM_TIS_CLIENT_CTX* client)
{
int fd;
int openFlags;
int fdFlags;
int fdFlags = 0;
UINT32 magic;
struct stat st;
struct stat pathSt;
FWTPM_TIS_REGS* shm;
sem_t* semCmd;
sem_t* semRsp;
char semCmdName[FWTPM_TIS_SEM_NAME_SIZE];
char semRspName[FWTPM_TIS_SEM_NAME_SIZE];
if (client == NULL) {
return BAD_FUNC_ARG;
@ -106,7 +131,8 @@ int FWTPM_TIS_ClientConnect(FWTPM_TIS_CLIENT_CTX* client)
/* Open existing shared memory file. O_NOFOLLOW and O_CLOEXEC are not
* universally available across POSIX targets — guard at compile time
* and fall back to fcntl(FD_CLOEXEC) for the close-on-exec semantics. */
* and fall back to lstat/inode checks and fcntl(FD_CLOEXEC). O_NONBLOCK
* prevents a substituted FIFO from blocking before fstat rejects it. */
openFlags = O_RDWR;
#ifdef O_NOFOLLOW
openFlags |= O_NOFOLLOW;
@ -114,6 +140,23 @@ int FWTPM_TIS_ClientConnect(FWTPM_TIS_CLIENT_CTX* client)
#ifdef O_CLOEXEC
openFlags |= O_CLOEXEC;
#endif
#ifdef O_NONBLOCK
openFlags |= O_NONBLOCK;
#endif
if (lstat(FWTPM_TIS_SHM_PATH, &pathSt) != 0) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: lstat(%s) failed: %d (%s)\n",
FWTPM_TIS_SHM_PATH, errno, strerror(errno));
#endif
return TPM_RC_FAILURE;
}
if (!S_ISREG(pathSt.st_mode)) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: %s is not a regular file\n",
FWTPM_TIS_SHM_PATH);
#endif
return TPM_RC_FAILURE;
}
fd = open(FWTPM_TIS_SHM_PATH, openFlags);
if (fd < 0) {
#ifdef DEBUG_WOLFTPM
@ -127,16 +170,60 @@ int FWTPM_TIS_ClientConnect(FWTPM_TIS_CLIENT_CTX* client)
if (fdFlags >= 0) {
(void)fcntl(fd, F_SETFD, fdFlags | FD_CLOEXEC);
}
#else
#elif !defined(O_NONBLOCK)
(void)fdFlags;
#endif
/* Verify file is large enough before mapping */
if (fstat(fd, &st) != 0 ||
st.st_size < (off_t)sizeof(FWTPM_TIS_REGS)) {
/* Authenticate the data-bearing endpoint before mapping it. Named
* semaphores carry wakeups only and are derived from this validated file
* owner below. */
if (fstat(fd, &st) != 0) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: shm file too small (expected %lu)\n",
(unsigned long)sizeof(FWTPM_TIS_REGS));
printf("fwTPM HAL: fstat(%s) failed: %d (%s)\n",
FWTPM_TIS_SHM_PATH, errno, strerror(errno));
#endif
close(fd);
return TPM_RC_FAILURE;
}
/* Check this ahead of the shared validator so a size mismatch gets the
* specific client/server rebuild diagnostic. */
if (st.st_size != (off_t)sizeof(FWTPM_TIS_REGS)) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: endpoint is %llu bytes; this build expects %llu "
"(rebuild client and server with matching options)\n",
(unsigned long long)st.st_size,
(unsigned long long)sizeof(FWTPM_TIS_REGS));
#endif
close(fd);
return TPM_RC_FAILURE;
}
if (FWTPM_TIS_ClientValidateShm(&st) != TPM_RC_SUCCESS ||
st.st_dev != pathSt.st_dev || st.st_ino != pathSt.st_ino) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: untrusted shm metadata (expected %lu bytes, "
"mode 0600, uid %lu)\n",
(unsigned long)sizeof(FWTPM_TIS_REGS),
(unsigned long)geteuid());
#endif
close(fd);
return TPM_RC_FAILURE;
}
#ifdef O_NONBLOCK
fdFlags = fcntl(fd, F_GETFL);
if (fdFlags < 0 ||
fcntl(fd, F_SETFL, fdFlags & ~O_NONBLOCK) != 0) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: failed to clear O_NONBLOCK\n");
#endif
close(fd);
return TPM_RC_FAILURE;
}
#endif
if (FWTPM_TIS_MakeSemNames((UINT64)st.st_uid, semCmdName,
sizeof(semCmdName), semRspName, sizeof(semRspName)) != 0) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: failed to derive semaphore names for uid %lu\n",
(unsigned long)st.st_uid);
#endif
close(fd);
return TPM_RC_FAILURE;
@ -152,11 +239,13 @@ int FWTPM_TIS_ClientConnect(FWTPM_TIS_CLIENT_CTX* client)
return TPM_RC_FAILURE;
}
/* Validate magic */
if (shm->magic != FWTPM_TIS_MAGIC) {
/* Acquire the validity sentinel before reading the published header. */
magic = FWTPM_TIS_LoadMagic(shm);
if (magic != FWTPM_TIS_MAGIC ||
shm->version != FWTPM_TIS_VERSION) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: bad magic 0x%08x (expected 0x%08x)\n",
(unsigned int)shm->magic, (unsigned int)FWTPM_TIS_MAGIC);
printf("fwTPM HAL: bad header magic=0x%08x version=%u\n",
(unsigned int)magic, (unsigned int)shm->version);
#endif
munmap(shm, sizeof(FWTPM_TIS_REGS));
close(fd);
@ -164,22 +253,22 @@ int FWTPM_TIS_ClientConnect(FWTPM_TIS_CLIENT_CTX* client)
}
/* Open existing semaphores (server creates them) */
semCmd = sem_open(FWTPM_TIS_SEM_CMD, 0);
semCmd = sem_open(semCmdName, 0);
if (semCmd == SEM_FAILED) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: sem_open(%s) failed: %d (%s)\n",
FWTPM_TIS_SEM_CMD, errno, strerror(errno));
semCmdName, errno, strerror(errno));
#endif
munmap(shm, sizeof(FWTPM_TIS_REGS));
close(fd);
return TPM_RC_FAILURE;
}
semRsp = sem_open(FWTPM_TIS_SEM_RSP, 0);
semRsp = sem_open(semRspName, 0);
if (semRsp == SEM_FAILED) {
#ifdef DEBUG_WOLFTPM
printf("fwTPM HAL: sem_open(%s) failed: %d (%s)\n",
FWTPM_TIS_SEM_RSP, errno, strerror(errno));
semRspName, errno, strerror(errno));
#endif
sem_close(semCmd);
munmap(shm, sizeof(FWTPM_TIS_REGS));
@ -187,10 +276,13 @@ int FWTPM_TIS_ClientConnect(FWTPM_TIS_CLIENT_CTX* client)
return TPM_RC_FAILURE;
}
/* Reject a mapping from an old server generation paired with newly
* recreated semaphore names. */
if (stat(FWTPM_TIS_SHM_PATH, &pathSt) != 0 ||
st.st_dev != pathSt.st_dev || st.st_ino != pathSt.st_ino) {
/* Reject a replaced pathname or metadata change after opening the
* per-owner semaphore pair. */
if (fstat(fd, &st) != 0 ||
FWTPM_TIS_ClientValidateShm(&st) != TPM_RC_SUCCESS ||
lstat(FWTPM_TIS_SHM_PATH, &pathSt) != 0 ||
!S_ISREG(pathSt.st_mode) || st.st_dev != pathSt.st_dev ||
st.st_ino != pathSt.st_ino) {
sem_close(semRsp);
sem_close(semCmd);
munmap(shm, sizeof(FWTPM_TIS_REGS));

13
src/fwtpm/fwtpm_tis.c
View File

@ -68,6 +68,15 @@ static UINT32 TisBuildSts(BYTE stsFlags, UINT16 burstCount)
return ((UINT32)burstCount << 8) | (UINT32)stsFlags;
}
static void TisPublishMagic(FWTPM_TIS_REGS* regs)
{
#if defined(__GNUC__) || defined(__clang__)
__atomic_store_n(&regs->magic, FWTPM_TIS_MAGIC, __ATOMIC_RELEASE);
#else
regs->magic = FWTPM_TIS_MAGIC;
#endif
}
/* Handle a single TIS register access */
static void TisHandleRegAccess(FWTPM_CTX* ctx, FWTPM_TIS_REGS* regs)
{
@ -436,7 +445,6 @@ int FWTPM_TIS_Init(FWTPM_CTX* ctx)
/* Initialize register state */
XMEMSET(regs, 0, sizeof(FWTPM_TIS_REGS));
regs->magic = FWTPM_TIS_MAGIC;
regs->version = FWTPM_TIS_VERSION;
/* Power-on register defaults. ACCESS is not stored here: it is served
@ -451,6 +459,9 @@ int FWTPM_TIS_Init(FWTPM_CTX* ctx)
regs->did_vid = FWTPM_TIS_DID_VID_VAL;
regs->rid = FWTPM_VERSION_PATCH;
/* Release-publish the validity sentinel after all client-visible state. */
TisPublishMagic(regs);
/* Auto power-on in TIS mode (no platform port to signal power) */
ctx->powerOn = 1;

64
src/fwtpm/fwtpm_tis_sem.c 100644
View File

@ -0,0 +1,64 @@
/* fwtpm_tis_sem.c
*
* Copyright (C) 2006-2026 wolfSSL Inc.
*
* This file is part of wolfTPM.
*
* wolfTPM is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* wolfTPM is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <wolftpm/tpm2_types.h>
#if defined(WOLFTPM_FWTPM_TIS) || defined(WOLFTPM_FWTPM_HAL)
#include <wolftpm/fwtpm/fwtpm_tis.h>
static int TisMakeSemName(const char* base, UINT64 ownerId, char* name,
size_t nameSz)
{
int nameLen;
if (base == NULL || name == NULL || nameSz == 0U) {
return -1;
}
nameLen = XSNPRINTF(name, nameSz, "%s-%016llx", base,
(unsigned long long)ownerId);
if (nameLen <= 0 || (size_t)nameLen >= nameSz) {
return -1;
}
return 0;
}
WOLFTPM_LOCAL int FWTPM_TIS_MakeSemNames(UINT64 ownerUid, char* semCmd,
size_t semCmdSz, char* semRsp, size_t semRspSz)
{
/* Namespacing only, not a cryptographic identity. The authenticated UID
* remains stable when the shared-memory pathname is removed after a
* crash, allowing the next server to collect both semaphore objects. */
UINT64 ownerId = ownerUid * 0x9E3779B185EBCA87ULL;
if (TisMakeSemName(FWTPM_TIS_SEM_CMD, ownerId, semCmd, semCmdSz) != 0 ||
TisMakeSemName(FWTPM_TIS_SEM_RSP, ownerId, semRsp,
semRspSz) != 0) {
return -1;
}
return 0;
}
#endif /* WOLFTPM_FWTPM_TIS || WOLFTPM_FWTPM_HAL */

74
src/fwtpm/fwtpm_tis_shm.c
View File

@ -58,11 +58,20 @@ typedef struct {
int shmFd; /* shm file descriptor */
sem_t* semCmd; /* command semaphore */
sem_t* semRsp; /* response semaphore */
char semCmdName[FWTPM_TIS_SEM_NAME_SIZE];
char semRspName[FWTPM_TIS_SEM_NAME_SIZE];
} FWTPM_TIS_SHM_CTX;
/* Single server per process */
static FWTPM_TIS_SHM_CTX gTisShmCtx;
static void TisShmUnlinkOldEndpoint(const char* semCmdName,
const char* semRspName)
{
(void)sem_unlink(semCmdName);
(void)sem_unlink(semRspName);
}
/* --- HAL Callbacks --- */
static int TisShmInit(void* ctx, FWTPM_TIS_REGS** regs)
@ -86,6 +95,8 @@ static int TisShmInit(void* ctx, FWTPM_TIS_REGS** regs)
shm->shmFd = -1;
shm->semCmd = NULL;
shm->semRsp = NULL;
shm->semCmdName[0] = '\0';
shm->semRspName[0] = '\0';
/* Use a fresh inode so locks from a crashed server generation do not
* prevent new clients from connecting to the replacement server. */
@ -94,7 +105,6 @@ static int TisShmInit(void* ctx, FWTPM_TIS_REGS** regs)
FWTPM_TIS_SHM_PATH, errno, strerror(errno));
return -1;
}
/* Create shared memory file */
fd = open(FWTPM_TIS_SHM_PATH, openFlags, 0600);
if (fd < 0) {
@ -103,13 +113,13 @@ static int TisShmInit(void* ctx, FWTPM_TIS_REGS** regs)
return -1;
}
/* A pre-existing file may carry attacker-controlled ownership or
* permissions; require our own UID and force 0600 (O_CREAT without
* O_EXCL cannot prevent the pre-creation race on its own). */
if (fstat(fd, &shmStat) != 0 || shmStat.st_uid != getuid() ||
/* Require our own UID and force 0600 on the newly created endpoint. */
if (fstat(fd, &shmStat) != 0 || !S_ISREG(shmStat.st_mode) ||
shmStat.st_uid != geteuid() || shmStat.st_nlink != 1 ||
fchmod(fd, S_IRUSR | S_IWUSR) != 0) {
fprintf(stderr, "fwTPM TIS: shm ownership/permission check failed\n");
close(fd);
(void)unlink(FWTPM_TIS_SHM_PATH);
return -1;
}
@ -117,6 +127,25 @@ static int TisShmInit(void* ctx, FWTPM_TIS_REGS** regs)
fprintf(stderr, "fwTPM TIS: ftruncate failed: %d (%s)\n",
errno, strerror(errno));
close(fd);
(void)unlink(FWTPM_TIS_SHM_PATH);
return -1;
}
if (fstat(fd, &shmStat) != 0 ||
shmStat.st_size != (off_t)sizeof(FWTPM_TIS_REGS) ||
(shmStat.st_mode & (S_IRWXU | S_IRWXG | S_IRWXO)) !=
(S_IRUSR | S_IWUSR)) {
fprintf(stderr, "fwTPM TIS: invalid shm endpoint metadata\n");
close(fd);
(void)unlink(FWTPM_TIS_SHM_PATH);
return -1;
}
if (FWTPM_TIS_MakeSemNames((UINT64)shmStat.st_uid,
shm->semCmdName, sizeof(shm->semCmdName),
shm->semRspName, sizeof(shm->semRspName)) != 0) {
fprintf(stderr, "fwTPM TIS: failed to derive semaphore names\n");
close(fd);
(void)unlink(FWTPM_TIS_SHM_PATH);
return -1;
}
@ -127,38 +156,41 @@ static int TisShmInit(void* ctx, FWTPM_TIS_REGS** regs)
errno, strerror(errno));
shm->regs = NULL;
close(fd);
(void)unlink(FWTPM_TIS_SHM_PATH);
return -1;
}
shm->shmFd = fd;
/* Create semaphores (remove stale ones first) */
sem_unlink(FWTPM_TIS_SEM_CMD);
sem_unlink(FWTPM_TIS_SEM_RSP);
shm->semCmd = sem_open(FWTPM_TIS_SEM_CMD, O_CREAT | O_EXCL, 0600, 0);
/* Remove stale names only after the data endpoint is ready, immediately
* before O_EXCL recreates them. Early startup failures therefore leave a
* still-running server generation's semaphore names intact. */
TisShmUnlinkOldEndpoint(shm->semCmdName, shm->semRspName);
shm->semCmd = sem_open(shm->semCmdName, O_CREAT | O_EXCL, 0600, 0);
if (shm->semCmd == SEM_FAILED) {
fprintf(stderr, "fwTPM TIS: sem_open(%s) failed: %d (%s)\n",
FWTPM_TIS_SEM_CMD, errno, strerror(errno));
shm->semCmdName, errno, strerror(errno));
shm->semCmd = NULL;
munmap(shm->regs, sizeof(FWTPM_TIS_REGS));
shm->regs = NULL;
close(fd);
shm->shmFd = -1;
(void)unlink(FWTPM_TIS_SHM_PATH);
return -1;
}
shm->semRsp = sem_open(FWTPM_TIS_SEM_RSP, O_CREAT | O_EXCL, 0600, 0);
shm->semRsp = sem_open(shm->semRspName, O_CREAT | O_EXCL, 0600, 0);
if (shm->semRsp == SEM_FAILED) {
fprintf(stderr, "fwTPM TIS: sem_open(%s) failed: %d (%s)\n",
FWTPM_TIS_SEM_RSP, errno, strerror(errno));
shm->semRspName, errno, strerror(errno));
sem_close(shm->semCmd);
sem_unlink(FWTPM_TIS_SEM_CMD);
sem_unlink(shm->semCmdName);
shm->semCmd = NULL;
shm->semRsp = NULL;
munmap(shm->regs, sizeof(FWTPM_TIS_REGS));
shm->regs = NULL;
close(fd);
shm->shmFd = -1;
(void)unlink(FWTPM_TIS_SHM_PATH);
return -1;
}
@ -167,7 +199,7 @@ static int TisShmInit(void* ctx, FWTPM_TIS_REGS** regs)
printf("fwTPM TIS: Shared memory at %s (%zu bytes)\n",
FWTPM_TIS_SHM_PATH, sizeof(FWTPM_TIS_REGS));
printf("fwTPM TIS: Semaphores: cmd=%s, rsp=%s\n",
FWTPM_TIS_SEM_CMD, FWTPM_TIS_SEM_RSP);
shm->semCmdName, shm->semRspName);
return 0;
}
@ -203,7 +235,11 @@ static void TisShmCleanup(void* ctx)
FWTPM_TIS_SHM_CTX* shm = (FWTPM_TIS_SHM_CTX*)ctx;
if (shm->regs != NULL) {
#if defined(__GNUC__) || defined(__clang__)
__atomic_store_n(&shm->regs->magic, 0U, __ATOMIC_RELEASE);
#else
shm->regs->magic = 0;
#endif
TPM2_ForceZero(shm->regs->reg_data,
sizeof(shm->regs->reg_data));
if (shm->semRsp != NULL && shm->semRsp != SEM_FAILED) {
@ -212,12 +248,16 @@ static void TisShmCleanup(void* ctx)
}
if (shm->semRsp != NULL && shm->semRsp != SEM_FAILED) {
sem_close(shm->semRsp);
sem_unlink(FWTPM_TIS_SEM_RSP);
if (shm->semRspName[0] != '\0') {
sem_unlink(shm->semRspName);
}
shm->semRsp = NULL;
}
if (shm->semCmd != NULL && shm->semCmd != SEM_FAILED) {
sem_close(shm->semCmd);
sem_unlink(FWTPM_TIS_SEM_CMD);
if (shm->semCmdName[0] != '\0') {
sem_unlink(shm->semCmdName);
}
shm->semCmd = NULL;
}
if (shm->regs != NULL) {

5
src/fwtpm/include.am
View File

@ -21,9 +21,14 @@ src_fwtpm_fwtpm_server_CPPFLAGS = -DWOLFTPM_FWTPM $(AM_CPPFLAGS)
src_fwtpm_fwtpm_server_LDADD = $(LIB_STATIC_ADD)
if BUILD_FWTPM_TIS
src_fwtpm_fwtpm_server_SOURCES += src/fwtpm/fwtpm_tis.c \
src/fwtpm/fwtpm_tis_sem.c \
src/fwtpm/fwtpm_tis_shm.c
src_fwtpm_fwtpm_server_CFLAGS += -DWOLFTPM_FWTPM_TIS
src_fwtpm_fwtpm_server_CPPFLAGS += -DWOLFTPM_FWTPM_TIS
src_fwtpm_fwtpm_server_LDADD += $(FWTPM_TIS_LIBS)
if !BUILD_FWTPM_ONLY
src_libwolftpm_la_SOURCES += src/fwtpm/fwtpm_tis_sem.c
endif
endif
# fwtpm_server doesn't link libwolftpm.la (it compiles its own copies with

3
src/include.am
View File

@ -4,6 +4,7 @@
if !BUILD_FWTPM_ONLY
lib_LTLIBRARIES+= src/libwolftpm.la
src_libwolftpm_la_LIBADD = $(FWTPM_TIS_LIBS)
src_libwolftpm_la_SOURCES = \
src/tpm2.c \
src/tpm2_util.c \
@ -20,7 +21,7 @@ src_libwolftpm_la_SOURCES += src/tpm2_swtpm.c
endif
if BUILD_WINAPI
src_libwolftpm_la_SOURCES += src/tpm2_winapi.c
src_libwolftpm_la_LIBADD = -ltbs
src_libwolftpm_la_LIBADD += -ltbs
endif
if BUILD_SPDM
# SPDM support using wolfSPDM library

8
tests/cmake_static_consumer/CMakeLists.txt 100644
View File

@ -0,0 +1,8 @@
cmake_minimum_required(VERSION 3.16)
project(wolftpm_static_consumer C)
find_package(wolftpm CONFIG REQUIRED)
add_library(wolftpm_static_consumer INTERFACE)
target_link_libraries(wolftpm_static_consumer INTERFACE wolfssl::wolftpm)

498
tests/fwtpm_hal_unit_tests.c 100644
View File

@ -0,0 +1,498 @@
/* fwtpm_hal_unit_tests.c
*
* Copyright (C) 2006-2026 wolfSSL Inc.
*
* This file is part of wolfTPM.
*
* wolfTPM is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* wolfTPM is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
/* Isolated tests for the POSIX fwTPM client HAL. The production source is
* included directly so each test can use PID-specific endpoint names without
* colliding with a running fwTPM server. */
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <wolftpm/tpm2.h>
#include <stdio.h>
#include <string.h>
#include <fcntl.h>
/* Keep this before sem_open interposition below so the macro cannot rewrite
* the system declaration into a conflicting TestSemOpen prototype. */
#include <semaphore.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <unistd.h>
static char gTestShmPath[96];
static char gTestAuxPath[96];
static char gTestSemCmdBase[16];
static char gTestSemRspBase[16];
static int gSwapAfterSemOpen;
static int gSemOpenCount;
static int gSwapFailed;
static int CreateEndpointFile(const char* path, mode_t mode,
off_t sizeAdjust, UINT32 magic, UINT32 version);
static int ReplaceEndpoint(void);
#define FWTPM_TIS_SHM_PATH gTestShmPath
#define FWTPM_TIS_SEM_CMD gTestSemCmdBase
#define FWTPM_TIS_SEM_RSP gTestSemRspBase
#define WOLFTPM_INCLUDE_IO_FILE
#include "../hal/tpm_io.h"
#include <wolftpm/fwtpm/fwtpm_tis.h>
static char gTestSemCmd[FWTPM_TIS_SEM_NAME_SIZE];
static char gTestSemRsp[FWTPM_TIS_SEM_NAME_SIZE];
/* tpm_io_fwtpm.c normally gets this helper from libwolftpm. */
static void TestForceZero(void* mem, word32 len)
{
volatile byte* p = (volatile byte*)mem;
while (len-- > 0U) {
*p++ = 0;
}
}
#include "../src/fwtpm/fwtpm_tis_sem.c"
static sem_t* TestSemOpen(const char* name, int oflag, ...)
{
sem_t* sem = sem_open(name, oflag);
if (sem != SEM_FAILED && gSwapAfterSemOpen) {
gSemOpenCount++;
if (gSemOpenCount == 2 && ReplaceEndpoint() != 0) {
gSwapFailed = 1;
}
}
return sem;
}
#define TPM2_ForceZero TestForceZero
#define sem_open TestSemOpen
#include "../hal/tpm_io_fwtpm.c"
#undef sem_open
#undef TPM2_ForceZero
static void CleanupEndpoint(void)
{
(void)sem_unlink(gTestSemRsp);
(void)sem_unlink(gTestSemCmd);
(void)unlink(gTestShmPath);
(void)unlink(gTestAuxPath);
gSwapAfterSemOpen = 0;
gSemOpenCount = 0;
gSwapFailed = 0;
}
static int CreateEndpointFile(const char* path, mode_t mode,
off_t sizeAdjust, UINT32 magic, UINT32 version)
{
FWTPM_TIS_REGS* regs;
off_t fileSize = (off_t)sizeof(FWTPM_TIS_REGS) + sizeAdjust;
int fd = -1;
int rc = -1;
if (fileSize <= 0) {
return -1;
}
fd = open(path, O_CREAT | O_EXCL | O_RDWR, 0600);
if (fd < 0 || fchmod(fd, mode) != 0 ||
ftruncate(fd, fileSize) != 0) {
goto exit;
}
if (fileSize >= (off_t)sizeof(FWTPM_TIS_REGS)) {
regs = (FWTPM_TIS_REGS*)mmap(NULL, sizeof(FWTPM_TIS_REGS),
PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
if (regs == MAP_FAILED) {
goto exit;
}
XMEMSET(regs, 0, sizeof(*regs));
regs->magic = magic;
regs->version = version;
(void)munmap(regs, sizeof(FWTPM_TIS_REGS));
}
rc = 0;
exit:
if (fd >= 0) {
(void)close(fd);
}
if (rc != 0) {
(void)unlink(path);
}
return rc;
}
static int ReplaceEndpoint(void)
{
(void)unlink(gTestAuxPath);
if (CreateEndpointFile(gTestAuxPath, 0600, 0, FWTPM_TIS_MAGIC,
FWTPM_TIS_VERSION) != 0) {
return -1;
}
if (rename(gTestAuxPath, gTestShmPath) != 0) {
(void)unlink(gTestAuxPath);
return -1;
}
return 0;
}
static int CreateEndpoint(mode_t mode, off_t sizeAdjust, UINT32 magic,
UINT32 version)
{
sem_t* semCmd = SEM_FAILED;
sem_t* semRsp = SEM_FAILED;
int rc = -1;
CleanupEndpoint();
if (FWTPM_TIS_MakeSemNames((UINT64)geteuid(), gTestSemCmd,
sizeof(gTestSemCmd), gTestSemRsp, sizeof(gTestSemRsp)) != 0 ||
CreateEndpointFile(gTestShmPath, mode, sizeAdjust, magic,
version) != 0) {
goto exit;
}
semCmd = sem_open(gTestSemCmd, O_CREAT | O_EXCL, 0600, 0);
semRsp = sem_open(gTestSemRsp, O_CREAT | O_EXCL, 0600, 0);
if (semCmd == SEM_FAILED || semRsp == SEM_FAILED) {
goto exit;
}
rc = 0;
exit:
if (semRsp != SEM_FAILED) {
(void)sem_close(semRsp);
}
if (semCmd != SEM_FAILED) {
(void)sem_close(semCmd);
}
if (rc != 0) {
CleanupEndpoint();
}
return rc;
}
static int ExpectRejected(const char* name, mode_t mode, off_t sizeAdjust,
UINT32 magic, UINT32 version)
{
FWTPM_TIS_CLIENT_CTX client;
int rc;
if (CreateEndpoint(mode, sizeAdjust, magic, version) != 0) {
printf("FAIL: %s setup\n", name);
return 1;
}
rc = FWTPM_TIS_ClientConnect(&client);
if (rc == TPM_RC_SUCCESS) {
FWTPM_TIS_ClientDisconnect(&client);
printf("FAIL: accepted %s endpoint\n", name);
CleanupEndpoint();
return 1;
}
printf("PASS: rejected %s endpoint\n", name);
CleanupEndpoint();
return 0;
}
static int ExpectAccepted(void)
{
FWTPM_TIS_CLIENT_CTX client;
int rc;
/* Default UID-derived names are covered by fwtpm_tis_sem_unit.test. */
if (CreateEndpoint(0600, 0, FWTPM_TIS_MAGIC,
FWTPM_TIS_VERSION) != 0) {
printf("FAIL: trusted endpoint setup\n");
return 1;
}
rc = FWTPM_TIS_ClientConnect(&client);
if (rc != TPM_RC_SUCCESS) {
printf("FAIL: rejected trusted endpoint\n");
CleanupEndpoint();
return 1;
}
FWTPM_TIS_ClientDisconnect(&client);
printf("PASS: accepted trusted endpoint\n");
CleanupEndpoint();
return 0;
}
static int ExpectDisconnectZeroized(void)
{
FWTPM_TIS_CLIENT_CTX client;
FWTPM_TIS_REGS* observer = MAP_FAILED;
int observerFd = -1;
int rc;
int idx;
int failed = 0;
if (CreateEndpoint(0600, 0, FWTPM_TIS_MAGIC,
FWTPM_TIS_VERSION) != 0) {
printf("FAIL: disconnect zeroization setup\n");
return 1;
}
observerFd = open(gTestShmPath, O_RDWR);
if (observerFd < 0) {
failed = 1;
goto exit;
}
observer = (FWTPM_TIS_REGS*)mmap(NULL, sizeof(*observer),
PROT_READ | PROT_WRITE, MAP_SHARED, observerFd, 0);
if (observer == MAP_FAILED) {
failed = 1;
goto exit;
}
rc = FWTPM_TIS_ClientConnect(&client);
if (rc != TPM_RC_SUCCESS) {
failed = 1;
goto exit;
}
XMEMSET(client.shm->reg_data, 0xA5, sizeof(client.shm->reg_data));
FWTPM_TIS_ClientDisconnect(&client);
for (idx = 0; idx < (int)sizeof(observer->reg_data); idx++) {
if (observer->reg_data[idx] != 0U) {
failed = 1;
break;
}
}
exit:
if (observer != MAP_FAILED) {
(void)munmap(observer, sizeof(*observer));
}
if (observerFd >= 0) {
(void)close(observerFd);
}
printf("%s: disconnect zeroized shared register data\n",
failed ? "FAIL" : "PASS");
CleanupEndpoint();
return failed;
}
static int ExpectSymlinkRejected(void)
{
FWTPM_TIS_CLIENT_CTX client;
int rc;
if (CreateEndpoint(0600, 0, FWTPM_TIS_MAGIC,
FWTPM_TIS_VERSION) != 0 ||
rename(gTestShmPath, gTestAuxPath) != 0 ||
symlink(gTestAuxPath, gTestShmPath) != 0) {
printf("FAIL: symlink setup\n");
CleanupEndpoint();
return 1;
}
rc = FWTPM_TIS_ClientConnect(&client);
if (rc == TPM_RC_SUCCESS) {
FWTPM_TIS_ClientDisconnect(&client);
printf("FAIL: accepted symlink endpoint\n");
CleanupEndpoint();
return 1;
}
printf("PASS: rejected symlink endpoint\n");
CleanupEndpoint();
return 0;
}
static int ExpectHardlinkRejected(void)
{
FWTPM_TIS_CLIENT_CTX client;
int rc;
if (CreateEndpoint(0600, 0, FWTPM_TIS_MAGIC,
FWTPM_TIS_VERSION) != 0 ||
link(gTestShmPath, gTestAuxPath) != 0) {
printf("FAIL: hardlink setup\n");
CleanupEndpoint();
return 1;
}
rc = FWTPM_TIS_ClientConnect(&client);
if (rc == TPM_RC_SUCCESS) {
FWTPM_TIS_ClientDisconnect(&client);
printf("FAIL: accepted hardlink endpoint\n");
CleanupEndpoint();
return 1;
}
printf("PASS: rejected hardlink endpoint\n");
CleanupEndpoint();
return 0;
}
static int ExpectFifoRejected(void)
{
FWTPM_TIS_CLIENT_CTX client;
int rc;
CleanupEndpoint();
if (mkfifo(gTestShmPath, 0600) != 0) {
printf("FAIL: FIFO setup\n");
return 1;
}
rc = FWTPM_TIS_ClientConnect(&client);
if (rc == TPM_RC_SUCCESS) {
FWTPM_TIS_ClientDisconnect(&client);
printf("FAIL: accepted FIFO endpoint\n");
CleanupEndpoint();
return 1;
}
printf("PASS: rejected FIFO endpoint\n");
CleanupEndpoint();
return 0;
}
static int ExpectSwapRejected(void)
{
FWTPM_TIS_CLIENT_CTX client;
int rc;
if (CreateEndpoint(0600, 0, FWTPM_TIS_MAGIC,
FWTPM_TIS_VERSION) != 0) {
printf("FAIL: pathname-swap setup\n");
return 1;
}
gSwapAfterSemOpen = 1;
rc = FWTPM_TIS_ClientConnect(&client);
if (gSwapFailed || gSemOpenCount != 2 || rc == TPM_RC_SUCCESS) {
if (rc == TPM_RC_SUCCESS) {
FWTPM_TIS_ClientDisconnect(&client);
}
printf("FAIL: accepted or failed to exercise pathname swap\n");
CleanupEndpoint();
return 1;
}
printf("PASS: rejected endpoint swapped after semaphore open\n");
CleanupEndpoint();
return 0;
}
static int TestMetadataValidation(void)
{
struct stat st;
uid_t expectedUid = geteuid();
XMEMSET(&st, 0, sizeof(st));
st.st_mode = S_IFREG | S_IRUSR | S_IWUSR;
st.st_uid = expectedUid;
st.st_nlink = 1;
st.st_size = (off_t)sizeof(FWTPM_TIS_REGS);
if (FWTPM_TIS_ClientValidateShm(&st) != TPM_RC_SUCCESS) {
printf("FAIL: rejected trusted metadata\n");
return 1;
}
st.st_uid = (uid_t)(expectedUid + 1U);
if (FWTPM_TIS_ClientValidateShm(&st) == TPM_RC_SUCCESS) {
printf("FAIL: accepted wrong-owner metadata\n");
return 1;
}
st.st_uid = expectedUid;
st.st_mode = S_IFIFO | S_IRUSR | S_IWUSR;
if (FWTPM_TIS_ClientValidateShm(&st) == TPM_RC_SUCCESS) {
printf("FAIL: accepted non-regular metadata\n");
return 1;
}
st.st_mode = S_IFREG | S_IRUSR | S_IWUSR;
st.st_nlink = 2;
if (FWTPM_TIS_ClientValidateShm(&st) == TPM_RC_SUCCESS) {
printf("FAIL: accepted multiply-linked metadata\n");
return 1;
}
printf("PASS: validated endpoint metadata\n");
return 0;
}
static int TestCustomSemPrefixes(void)
{
char semCmd[FWTPM_TIS_SEM_NAME_SIZE];
char semRsp[FWTPM_TIS_SEM_NAME_SIZE];
char otherCmd[FWTPM_TIS_SEM_NAME_SIZE];
char otherRsp[FWTPM_TIS_SEM_NAME_SIZE];
UINT64 ownerUid = (UINT64)geteuid();
size_t cmdPrefixSz = XSTRLEN(gTestSemCmdBase);
size_t rspPrefixSz = XSTRLEN(gTestSemRspBase);
if (FWTPM_TIS_MakeSemNames(ownerUid, semCmd, sizeof(semCmd), semRsp,
sizeof(semRsp)) != 0 ||
FWTPM_TIS_MakeSemNames(ownerUid + 1U, otherCmd,
sizeof(otherCmd), otherRsp, sizeof(otherRsp)) != 0 ||
XSTRNCMP(semCmd, gTestSemCmdBase, cmdPrefixSz) != 0 ||
XSTRNCMP(semRsp, gTestSemRspBase, rspPrefixSz) != 0 ||
semCmd[cmdPrefixSz] != '-' || semRsp[rspPrefixSz] != '-' ||
XSTRCMP(semCmd, otherCmd) == 0 ||
XSTRCMP(semRsp, otherRsp) == 0) {
printf("FAIL: caller semaphore prefixes lost UID namespacing\n");
return 1;
}
printf("PASS: namespaced caller-defined semaphore prefixes\n");
return 0;
}
int main(void)
{
int failures = 0;
long pid = (long)getpid();
unsigned int semId = (unsigned int)pid;
(void)snprintf(gTestShmPath, sizeof(gTestShmPath),
"/tmp/wolftpm-fwtpm-hal-%ld.shm", pid);
(void)snprintf(gTestAuxPath, sizeof(gTestAuxPath),
"/tmp/wolftpm-fwtpm-hal-%ld.aux", pid);
(void)snprintf(gTestSemCmdBase, sizeof(gTestSemCmdBase),
"/c%x", semId);
(void)snprintf(gTestSemRspBase, sizeof(gTestSemRspBase),
"/r%x", semId);
failures += ExpectRejected("group-readable", 0640, 0,
FWTPM_TIS_MAGIC, FWTPM_TIS_VERSION);
failures += ExpectRejected("world-readable", 0604, 0,
FWTPM_TIS_MAGIC, FWTPM_TIS_VERSION);
failures += ExpectRejected("undersized", 0600, -1,
FWTPM_TIS_MAGIC, FWTPM_TIS_VERSION);
failures += ExpectRejected("oversized", 0600, 1,
FWTPM_TIS_MAGIC, FWTPM_TIS_VERSION);
failures += ExpectRejected("bad magic", 0600, 0,
FWTPM_TIS_MAGIC ^ 1U, FWTPM_TIS_VERSION);
failures += ExpectRejected("bad version", 0600, 0,
FWTPM_TIS_MAGIC, FWTPM_TIS_VERSION + 1U);
failures += ExpectSymlinkRejected();
failures += ExpectHardlinkRejected();
failures += ExpectFifoRejected();
failures += ExpectSwapRejected();
failures += ExpectAccepted();
failures += ExpectDisconnectZeroized();
failures += TestMetadataValidation();
failures += TestCustomSemPrefixes();
CleanupEndpoint();
printf("fwTPM HAL endpoint tests: %s\n",
failures == 0 ? "passed" : "failed");
return failures == 0 ? 0 : 1;
}

71
tests/fwtpm_tis_sem_unit_tests.c 100644
View File

@ -0,0 +1,71 @@
/* fwtpm_tis_sem_unit_tests.c
*
* Copyright (C) 2006-2026 wolfSSL Inc.
*
* This file is part of wolfTPM.
*
* wolfTPM is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* wolfTPM is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <wolftpm/tpm2_types.h>
#include <wolftpm/fwtpm/fwtpm_tis.h>
#include <stdio.h>
#include <string.h>
static int TestSemNames(void)
{
const UINT64 uidA = 17U;
const UINT64 uidB = 18U;
char cmdA[FWTPM_TIS_SEM_NAME_SIZE];
char rspA[FWTPM_TIS_SEM_NAME_SIZE];
char cmdB[FWTPM_TIS_SEM_NAME_SIZE];
char rspB[FWTPM_TIS_SEM_NAME_SIZE];
char expectedCmd[FWTPM_TIS_SEM_NAME_SIZE];
char expectedRsp[FWTPM_TIS_SEM_NAME_SIZE];
if (FWTPM_TIS_MakeSemNames(uidA, cmdA, sizeof(cmdA), rspA,
sizeof(rspA)) != 0 ||
FWTPM_TIS_MakeSemNames(uidB, cmdB, sizeof(cmdB), rspB,
sizeof(rspB)) != 0) {
printf("FAIL: could not derive semaphore names\n");
return 1;
}
/* Pinned vector for uid 17: do not recompute the production hash here. */
(void)XSNPRINTF(expectedCmd, sizeof(expectedCmd), "%s-%s",
FWTPM_TIS_SEM_CMD, "81af14c9e4a872f7");
(void)XSNPRINTF(expectedRsp, sizeof(expectedRsp), "%s-%s",
FWTPM_TIS_SEM_RSP, "81af14c9e4a872f7");
if (strcmp(cmdA, expectedCmd) != 0 || strcmp(rspA, expectedRsp) != 0) {
printf("FAIL: semaphore name has the wrong UID suffix\n");
return 1;
}
if (strcmp(cmdA, cmdB) == 0 || strcmp(rspA, rspB) == 0) {
printf("FAIL: different UIDs produced the same semaphore names\n");
return 1;
}
printf("fwTPM TIS semaphore tests: passed\n");
return 0;
}
int main(void)
{
return TestSemNames();
}

17
tests/include.am
View File

@ -37,6 +37,23 @@ tests_fwtpm_unit_test_CPPFLAGS = \
tests_fwtpm_unit_test_LDADD = $(LIB_STATIC_ADD)
endif
if BUILD_FWTPM_TIS
check_PROGRAMS += tests/fwtpm_hal_unit.test tests/fwtpm_tis_sem_unit.test
noinst_PROGRAMS += tests/fwtpm_hal_unit.test tests/fwtpm_tis_sem_unit.test
tests_fwtpm_hal_unit_test_SOURCES = tests/fwtpm_hal_unit_tests.c
tests_fwtpm_hal_unit_test_CFLAGS = \
-DWOLFTPM_FWTPM_HAL -DWOLFTPM_ADV_IO -DWOLFTPM_EXAMPLE_HAL $(AM_CFLAGS)
tests_fwtpm_hal_unit_test_CPPFLAGS = \
-DWOLFTPM_FWTPM_HAL -DWOLFTPM_ADV_IO -DWOLFTPM_EXAMPLE_HAL $(AM_CPPFLAGS)
tests_fwtpm_hal_unit_test_LDADD = $(FWTPM_TIS_LIBS)
tests_fwtpm_tis_sem_unit_test_SOURCES = \
tests/fwtpm_tis_sem_unit_tests.c \
src/fwtpm/fwtpm_tis_sem.c
tests_fwtpm_tis_sem_unit_test_CFLAGS = -DWOLFTPM_FWTPM_TIS $(AM_CFLAGS)
tests_fwtpm_tis_sem_unit_test_CPPFLAGS = -DWOLFTPM_FWTPM_TIS $(AM_CPPFLAGS)
tests_fwtpm_tis_sem_unit_test_LDADD = $(FWTPM_TIS_LIBS)
endif
# TPM make check: manages server, runs unit.test + run_examples.sh
# Used for --enable-fwtpm builds
if BUILD_FWTPM

8
tests/unit_tests.c
View File

@ -4447,9 +4447,15 @@ static void test_TPM2_DispatchCommand_overflow(void)
XMEMSET(small, 0x5A, sizeof(small));
XMEMSET(&ctx, 0, sizeof(ctx));
/* timeoutTries 0, so this performs no IO but does set the active ctx */
/* timeoutTries 0, so this performs no IO but does set the active ctx. */
#if defined(WOLFTPM_LINUX_DEV) || defined(WOLFTPM_SWTPM) || \
defined(WOLFTPM_WINAPI)
AssertIntEQ(TPM2_Init_minimal(&ctx), TPM_RC_SUCCESS);
ctx.ioCb = test_ovf_ioCb;
#else
AssertIntEQ(TPM2_Init_ex(&ctx, test_ovf_ioCb, NULL, 0),
TPM_RC_SUCCESS);
#endif
/* Control: a payload that fits is not refused here, it goes on to the
* transport and fails there instead. This is what makes the guard

15
wolftpm/fwtpm/fwtpm_tis.h
View File

@ -36,7 +36,8 @@
extern "C" {
#endif
/* Shared memory and semaphore paths (POSIX transport defaults) */
/* Shared-memory path and semaphore-name prefixes (POSIX transport defaults).
* Every semaphore prefix receives a per-UID suffix. */
#ifndef FWTPM_TIS_SHM_PATH
#define FWTPM_TIS_SHM_PATH "/tmp/fwtpm.shm"
#endif
@ -47,9 +48,13 @@
#define FWTPM_TIS_SEM_RSP "/fwtpm_rsp"
#endif
/* Holds a leading slash, the 251 characters Linux permits after it, and NUL.
* Shorter platform limits are enforced by sem_open(). */
#define FWTPM_TIS_SEM_NAME_SIZE 253
/* Magic and version for shared memory validation */
#define FWTPM_TIS_MAGIC 0x57544953UL /* "WTIS" */
#define FWTPM_TIS_VERSION 1
#define FWTPM_TIS_VERSION 2
/* Default burst count (bytes per FIFO transfer) */
#ifndef FWTPM_TIS_BURST_COUNT
@ -151,6 +156,12 @@ typedef struct FWTPM_TIS_REGS {
/* Backward compatibility alias */
typedef FWTPM_TIS_REGS FWTPM_TIS_SHM;
#if defined(WOLFTPM_FWTPM_TIS) || defined(WOLFTPM_FWTPM_HAL)
/* Build the effective POSIX semaphore names for an authenticated owner UID. */
WOLFTPM_LOCAL int FWTPM_TIS_MakeSemNames(UINT64 ownerUid, char* semCmd,
size_t semCmdSz, char* semRsp, size_t semRspSz);
#endif
/* --- TIS Transport HAL (server-side) ---
* Abstracts the transport between client and server for TIS register