- NATIONS_PSK mode check (tpm2_spdm.c) - Only affects PSK mode which was already broken (raw path instead of VENDOR_DEFINED)
- END_SESSION (tpm2_wrap.c) - New behavior but only adds an END_SESSION before the existing cleanup. If it fails, cleanup still proceeds.
- Nations auto-connect (tpm2_wrap.c:279) - Only fires when spdmOnlyDetected is true (TPM locked in SPDM-only mode and TPM2_Startup returned
TPM_RC_DISABLED). Normal operation never hits this path.
- VdCode validation (spdm_tcg.c) - This one could theoretically break something if a response VdCode doesn't match. But all callers like
wolfSPDM_TCG_GetPubKey() already validate VdCode independently (line 316-321), so the existing code was already checking this for specific commands.
- VCA skip in PSK (spdm_psk.c) - Changes the transcript hash. Needs firmware 0.1.0.16 + NS350 to also skip VCA. Vision confirmed this works.
- TPM_CMD_Lx defines / comments - No behavioral change.
- Renamed spdm_demo to spdm_ctrl: file, binary, internal demo_* functions to ctrl_*, all references in
include.am, spdm_test.sh, .gitignore, CLAUDE.md, both READMEs
- README mentions Nations: title updated to Nuvoton NPCT75x and Nations NS350 TPMs, added Nations build section
- README section header renamed from Demo Commands to Setup/Control Commands
- README added reset pin control section: documents GPIO reset requirement, Pi-specific example, custom hardware
design guidance
- Moved spdm_tcg.c to common build section, no longer conditional on Nuvoton/Nations in src/spdm/include.am
- Removed redundant wolfSSL options include from spdm_internal.h since tpm2_types.h handles this
- Added WOLFTPM_SPDM_TCG generic guard as auto-define in spdm_types.h, replaced ~30 occurrences of #if defined(WOLFSPDM_NUVOTON) || defined(WOLFSPDM_NATIONS) across all files
David Garske
Aidan Garske