Use unshare --user --net to isolate fwtpm_check.sh TCP ports in CI, eliminating flaky port conflicts on shared runners. Add macOS CI with socket transport tests. Add Windows socket portability (Winsock2) and build-only CI via CMake.
Add portable firmware TPM 2.0 implementation (fwTPM) built on wolfCrypt.
Implements 105/113 TPM 2.0 v1.38 commands (93%) as a standalone server
with socket and TIS transports, NV storage, and full CI/fuzz coverage.
- src/tpm2_wrap.c: wolfTPM2_Init auto-SPDM path now calls vendor-specific
wolfTPM2_SpdmConnectNuvoton/Nations (which sets TIS I/O, mode, and the
host ephemeral key pair for mutual auth). Previous refactor to the
generic wolfTPM2_SpdmConnect dropped that setup, so FINISH failed with
WOLFSPDM_E_PEER_ERROR whenever the TPM was in SPDM-only-locked mode.
- src/tpm2_spdm.c: wolfSPDM_ParseVendorDefined returns payload dataLen
(>=0) on success per spdm_tcg.c:72 convention. wolfTPM2_SPDM_SecuredExchange
was treating any non-zero return as an error, so the first TPM command
over SPDM (10-byte Startup response) bubbled up as rc=0xa.
- tests/unit_tests.c: Add test_tpm_alg_supported() helper that queries
TPM_CAP_ALGS and skip test_wolfTPM2_EccSignVerifyDig iterations when the
hash isn't supported. Nuvoton NPCT75x lacks SHA512 and returns
TPM_RC_SIZE parameter 1 (not TPM_RC_HASH), so the prior post-hoc skip
couldn't catch it.
- .github/workflows/hw-spdm-test.yml: New workflow targeting a self-hosted
Raspberry Pi runner. Runs examples/spdm/spdm_test.sh against real Nuvoton
hardware. Fork-PR gated. Health check soft-fails with a warning if the
Pi is unhealthy so merging isn't blocked on a flaky runner. Nations
matrix entry scaffolded (commented) for when the NS350 is wired.
- scripts/hw-runner-health-check.sh: Pre-flight that verifies /dev/spidev,
/dev/gpiochip, and gpiod are present+accessible before the build.
aidan garske
David Garske
Aidan Garske
Elms