Add Infineon OPTIGA SLB9678 vendor commands and a plain TCG identity mode

[dgarske]

Description

Adds the Infineon OPTIGA SLB9678 vendor command set, and a WOLFSPDM_MODE_TCG for a part that implements the TCG binding but adds no vendor commands to the handshake.

What it adds

• src/vendor/spdm_infineon.c, wolfspdm/spdm_infineon.h - GET_STS, SPDM_ONLY, PSK_SET, PSK_CLEAR, and a PSK clear carrying the VCA transcript
• wolfspdm/spdm.h - WOLFSPDM_MODE_TCG and wolfSPDM_HasIO
• configure.ac, Makefile.am - --enable-infineon, implying --enable-tcg
• a plain TCG entry in wolfSPDM_IsTcgMode, wolfSPDM_Connect and wolfSPDM_KeyExOpaque; without them such a part gets MCTP framing, an invalid-argument return and the wrong KEY_EXCHANGE opaque block

Testing

Validated against an SLB9678 on firmware 45.91 over I2C from an Infineon PSOC Control C3 (C3M6): handshake against a pinned responder key, a TPM command inside the session, clean close. Builds clean with --enable-infineon, with --disable-tcg and by default; make check passes.

[Copilot]

🟡 Changes recommended

Direct macro builds fail to imply TCG support, and the advertised Infineon PSK connection alias is undefined.

3 open findings

• Infineon macro does not enable required TCG definitions · New
• Document the new Infineon configure option · New
• Add test coverage for TCG key exchange opaque encoding · New

What changed in this PR

Adds Infineon OPTIGA SLB9678 vendor commands and vendor-neutral TCG identity mode support.

Changes:

• Adds Infineon status, lock, and PSK provisioning APIs.
• Adds plain TCG mode selection and KEY_EXCHANGE opaque data.
• Adds Infineon build configuration and transport detection.

File	Description
wolfspdm/​spdm.h	Exposes TCG mode, PSK alias, Infineon API, and I/O detection.
wolfspdm/​spdm_infineon.h	Declares Infineon commands and status structures.
src/​vendor/​spdm_infineon.c	Implements Infineon vendor commands.
src/​spdm_msg.c	Adds TCG-specific KEY_EXCHANGE opaque data.
src/​spdm_internal.h	Recognizes plain TCG mode.
src/​spdm_context.c	Implements I/O detection and TCG mode dispatch.
Makefile.am	Builds and installs Infineon components.
configure.ac	Adds --enable-infineon.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

PSK commands can report success without validating acknowledgements, and repeated VCA clear attempts can exhaust the transcript buffer.

0 open findings

3 resolved since last review

• Infineon macro does not enable required TCG definitions
• Add test coverage for TCG key exchange opaque encoding
• Document the new Infineon configure option

🧠 Review effort: Balanced

[aidangarske]

Skoll Code Review

Scan type: review

Overall recommendation: COMMENT
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] Advertised Infineon PSK alias does not exist — wolfspdm/spdm_infineon.h:87
• [Medium] The Infineon feature is never compiled in CI — Makefile.am:30-32
• [Medium] New public behavior lacks direct unit coverage — test/unit_test.c:2415-2423
• [Medium] API reference omits the new public surface — wolfspdm/spdm.h:38-44

Review generated by Skoll