libtcgtpm: bump TPM reference implementation to v184

TCG released a new v184 version TPM reference implementation

Unfortunately, during the v184 release they accidentally reverted our change
to disable pthread. They were quick to cherry pick it back, so now on top of
v184 tag there is the commit bc29a21 ("Re-merge "Allow disabling the pthread
support check"") that we can use in our `libtcgtpm`.

Update also TpmConfiguration with the upstream one; disable SIMULATION
and ALLOW_FORCE_FAILURE_MODE as before. CRYPTO_LIB_REPORTING now
depends on SIMULATION, so we don't need to explicitly disable it
anymore. CC_Vendor_TCG_Test is also disabled to avoid build issue.

So this is the diff of our configuration and the default one available
upstream:
    $ diff -ru libtcgtpm/deps/tpm-20-ref/TPMCmd/TpmConfiguration libtcgtpm/deps/TpmConfiguration
    diff --color -ru libtcgtpm/deps/tpm-20-ref/TPMCmd/TpmConfiguration/TpmConfiguration/TpmBuildSwitches.h libtcgtpm/deps/TpmConfiguration/TpmConfiguration/TpmBuildSwitches.h
    --- libtcgtpm/deps/tpm-20-ref/TPMCmd/TpmConfiguration/TpmConfiguration/TpmBuildSwitches.h	2025-10-02 09:33:46.352717543 +0200
    +++ libtcgtpm/deps/TpmConfiguration/TpmConfiguration/TpmBuildSwitches.h	2025-10-02 12:06:27.662628186 +0200
    @@ -49,7 +49,7 @@
     // macros will make sure that it is set correctly. A simulated TPM would include a
     // Virtual TPM. The interfaces for a Virtual TPM should be modified from the standard
     // ones in the Simulator project.
    -#define SIMULATION                  YES
    +#define SIMULATION                  NO

     // ENABLE_TPM_DEBUG_PRINT enables arbitrary string printing.
     // enables the TPM_DEBUG_PRINT macro to route debugging strings
    @@ -102,7 +102,7 @@
     // ability of the platform library to force failure mode while leaving the rest
     // of the TPM behavior alone.  Useful for testing when the full set of options
     // controlled by SIMULATION may not be desired.
    -#define ALLOW_FORCE_FAILURE_MODE    YES
    +#define ALLOW_FORCE_FAILURE_MODE    NO

     ////////////////////////////////////////////////////////////////
     // Internal checks
    diff --color -ru libtcgtpm/deps/tpm-20-ref/TPMCmd/TpmConfiguration/TpmConfiguration/VendorCommands/VendorCommandList.h libtcgtpm/deps/TpmConfiguration/TpmConfiguration/VendorCommands/VendorCommandList.h
    --- libtcgtpm/deps/tpm-20-ref/TPMCmd/TpmConfiguration/TpmConfiguration/VendorCommands/VendorCommandList.h	2025-10-02 09:33:46.353621935 +0200
    +++ libtcgtpm/deps/TpmConfiguration/TpmConfiguration/VendorCommands/VendorCommandList.h	2025-10-02 13:17:41.814989897 +0200
    @@ -7,7 +7,7 @@
     #  error This file should be included only within TpmProfile_CommandList.h
     #endif

    -#define CC_Vendor_TCG_Test CC_YES
    +#define CC_Vendor_TCG_Test CC_NO

     #define VENDOR_COMMAND_ARRAY_COUNT (CC_Vendor_TCG_Test)

    Only in libtcgtpm/deps/tpm-20-ref/TPMCmd/TpmConfiguration: TpmVendorCommandHandlers

Closes coconut-svsm#829
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>

Author: stefano-garzarella

libtcgtpm/deps/TpmConfiguration/CMakeLists.txt

@@ -1,8 +1,3 @@
-# Microsoft Reference Implementation for TPM 2.0
-# Copyright (c) Microsoft Corporation
-# This software is being made available under certain license terms, as detailed at
-# https://github.com/microsoft/ms-tpm-20-ref/blob/main/LICENSE
-#
 ##########################################################
 # DO NOT MODIFY - TPM Configuration Library
 ##########################################################
@@ -43,8 +38,24 @@ install(FILES
         ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/TpmProfile_Common.h
         ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/TpmProfile_ErrorCodes.h
         ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/TpmProfile_Misc.h
-        ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/VendorInfo.h
         DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/TpmConfiguration)
 
+install(FILES
+        ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/VendorCommands/VendorCommandList.h
+        ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/VendorCommands/CommandAttributeData_s_ccAttr.inl
+        ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/VendorCommands/CommandAttributeData_s_commandAttributes.inl
+        ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/VendorCommands/CommandDispatchData_CommandStructures.inl
+        ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/VendorCommands/CommandDispatchData_s_CommandDataArray.inl
+        ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/VendorCommands/CommandDispatcher.inl
+        ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/VendorCommands/HandleProcess.inl
+        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/TpmConfiguration/VendorCommands)
+
+install(FILES
+        ${CMAKE_CURRENT_SOURCE_DIR}/TpmConfiguration/VendorCommands/prototypes/Vendor_TCG_Test_fp.h
+        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/TpmConfiguration/VendorCommands/prototypes)
+
+
 # LAST: create the targets.cmake file for this package
 export_targets_cmake_file(${PROJECT_NAME})
+
+add_subdirectory(TpmVendorCommandHandlers)

libtcgtpm/deps/TpmConfiguration/TpmConfiguration/TpmBuildSwitches.h

@@ -51,18 +51,28 @@
 // ones in the Simulator project.
 #define SIMULATION                  NO
 
+// ENABLE_TPM_DEBUG_PRINT enables arbitrary string printing.
+// enables the TPM_DEBUG_PRINT macro to route debugging strings
+// to the _plat_debug_out function
+#define ENABLE_TPM_DEBUG_PRINT      (YES * SIMULATION)
+
+//  ENABLE_TPM_DEBUG_TRACE enables code tracing macros - depends on TPM_DEBUG_PRINT
+#define ENABLE_TPM_DEBUG_TRACE      (NO  * ENABLE_TPM_DEBUG_PRINT)
+
+//  ENABLE_CRYPTO_DEBUG enables printing of actual crypto values. This is entirely insecure.
+#define ENABLE_CRYPTO_DEBUG         (YES * ENABLE_TPM_DEBUG_PRINT)
 
 // The CRYPTO_LIB_REPORTING switch allows the TPM to report its
 // crypto library implementation, e.g., at simulation startup.
-#define CRYPTO_LIB_REPORTING        NO
+#define CRYPTO_LIB_REPORTING        (YES * SIMULATION)
 
 // If doing debug, can set the DRBG to print out the intermediate test values.
 // Before enabling this, make sure that the dbgDumpMemBlock() function
 // has been added someplace (preferably, somewhere in CryptRand.c)
 #define DRBG_DEBUG_PRINT            (NO  * DEBUG)
 
 // This define is used to control the debug for the CertifyX509 command.
-#define CERTIFYX509_DEBUG           (YES * DEBUG)
+#define CERTIFYX509_DEBUG           (NO * DEBUG)
 
 // This provides fixed seeding of the RNG when doing debug on a simulator. This
 // should allow consistent results on test runs as long as the input parameters
@@ -89,9 +99,9 @@
 ////////////////////////////////////////////////////////////////
 // The SIMULATION flag can enable test crypto behaviors and caching that
 // significantly change the behavior of the code.  This flag controls only the
-// g_forceFailureMode flag in the TPM library while leaving the rest of the TPM
-// behavior alone.  Useful for testing when the full set of options controlled by
-// SIMULATION may not be desired.
+// ability of the platform library to force failure mode while leaving the rest
+// of the TPM behavior alone.  Useful for testing when the full set of options
+// controlled by SIMULATION may not be desired.
 #define ALLOW_FORCE_FAILURE_MODE    NO
 
 ////////////////////////////////////////////////////////////////
@@ -144,37 +154,12 @@
 ////////////////////////////////////////////////////////////////
 // Implementation alternatives - don't  change external behavior
 ////////////////////////////////////////////////////////////////
-
-// Define TABLE_DRIVEN_DISPATCH to use tables rather than case statements
-// for command dispatch and handle unmarshaling
-#define TABLE_DRIVEN_DISPATCH       YES
+// does the target system have longjmp support, AND we want to use it?
+#define LONGJMP_SUPPORTED           NO
 
 // This define is used to enable the new table-driven marshaling code.
 #define TABLE_DRIVEN_MARSHAL        NO
 
-// This switch allows use of #defines in place of pass-through marshaling or
-// unmarshaling code. A pass-through function just calls another function to do
-// the required function and does no parameter checking of its own. The
-// table-driven dispatcher calls directly to the lowest level
-// marshaling/unmarshaling code and by-passes any pass-through functions.
-#define USE_MARSHALING_DEFINES      YES
-
-// Switch added to support packed lists that leave out space associated with
-// unimplemented commands. Comment this out to use linear lists.
-// Note: if vendor specific commands are present, the associated list is always
-// in compressed form.
-#define COMPRESSED_LISTS            YES
-
-// This define is used to eliminate the use of bit-fields. It can be enabled for big-
-// or little-endian machines. For big-endian architectures that numbers bits in
-// registers from left to right (MSb0) this must be enabled. Little-endian machines
-// number from right to left with the least significant bit having assigned a bit
-// number of 0. These are LSb0 machines (they are also little-endian so they are also
-// least-significant byte 0 (LSB0) machines. Big-endian (MSB0) machines may number in
-// either direction (MSb0 or LSb0). For an MSB0+MSb0 machine this value is required to
-// be 'NO'
-#define USE_BIT_FIELD_STRUCTURES    NO
-
 // Enable the generation of RSA primes using a sieve.
 #define RSA_KEY_SIEVE               YES
 
@@ -207,6 +192,6 @@
 #define FAIL_TRACE                  YES
 
 // TODO_RENAME_INC_FOLDER: public refers to the TPM_CoreLib public headers
-#include <public/CompilerDependencies.h>
+#include <tpm_public/CompilerDependencies.h>
 
 #endif  // _TPM_BUILD_SWITCHES_H_

libtcgtpm/deps/TpmConfiguration/TpmConfiguration/TpmProfile.h

@@ -8,6 +8,4 @@
 #include <TpmConfiguration/TpmProfile_CommandList.h>
 #include <TpmConfiguration/TpmProfile_Misc.h>
 #include <TpmConfiguration/TpmProfile_ErrorCodes.h>
-#include <TpmConfiguration/VendorInfo.h>
-
 #endif  // _TPM_PROFILE_H_

libtcgtpm/deps/TpmConfiguration/TpmConfiguration/TpmProfile_CommandList.h

@@ -12,31 +12,34 @@
 #  error CC_YES and CC_NO should be defined by the command line file, not before
 #endif
 
+// Change these definitions to turn all commands ON or OFF. That is, to turn all
+// commands on, set CC_NO to YES. This is intended as a debug feature.
 #define CC_YES YES
 #define CC_NO  NO
 
-//
+// do not format automatically - the comments confuse clang-format.
+// clang-format off
+
 // Defines for Implemented Commands
-//
 
 // Commands that are defined in the spec, but not implemented for various
 // reasons:
 
 // The TPM reference implementation does not implement attached-component
 // features, and the Compliance test suite has no test cases.
-#define CC_AC_GetCapability CC_NO
-#define CC_AC_Send          CC_NO
+#define CC_AC_GetCapability           CC_NO
+#define CC_AC_Send                    CC_NO
 
 // The TPM reference implementation does not implement firmware upgrade.
-#define CC_FieldUpgradeData  CC_NO
-#define CC_FieldUpgradeStart CC_NO
-#define CC_FirmwareRead      CC_NO
+#define CC_FieldUpgradeData           CC_NO
+#define CC_FieldUpgradeStart          CC_NO
+#define CC_FirmwareRead               CC_NO
 
 // A prototype of CertifyX509 is provided here for informative purposes only.
 // While all of the TPM reference implementation is provided "AS IS" without any
 // warranty, the current design and implementation of CertifyX509 are considered
 // to be especially unsuitable for product use.
-#define CC_CertifyX509 CC_NO
+#define CC_CertifyX509                CC_NO
 
 // Normal commands:
 
@@ -155,11 +158,16 @@
 #define CC_StirRandom                 CC_YES
 #define CC_TestParms                  CC_YES
 #define CC_Unseal                     CC_YES
-#define CC_Vendor_TCG_Test            CC_YES
 #define CC_VerifySignature            CC_YES
 #define CC_ZGen_2Phase                (CC_YES && ALG_ECC)
 #define CC_NV_DefineSpace2            CC_YES
 #define CC_NV_ReadPublic2             CC_YES
 #define CC_SetCapability              CC_NO
+#define CC_ReadOnlyControl            CC_YES
+#define CC_PolicyTransportSPDM        CC_YES
+
+// clang-format on
+
+#include <TpmConfiguration/VendorCommands/VendorCommandList.h>
 
 #endif  // _TPM_PROFILE_COMMAND_LIST_H_

libtcgtpm/deps/TpmConfiguration/TpmConfiguration/TpmProfile_Common.h

@@ -25,9 +25,6 @@
 // Are building for a BIG_ENDIAN processor?
 #define  BIG_ENDIAN_TPM             NO
 #define  LITTLE_ENDIAN_TPM          !BIG_ENDIAN_TPM
-// Does the processor put the most-significant bit at bit position 0?
-#define MOST_SIGNIFICANT_BIT_0      NO
-#define LEAST_SIGNIFICANT_BIT_0     !MOST_SIGNIFICANT_BIT_0
 // Does processor support Auto align?
 #define  AUTO_ALIGN                 NO
 
@@ -175,6 +172,8 @@
 #define RH_ACT_E                                ( NO * ACT_SUPPORT)
 #define RH_ACT_F                                ( NO * ACT_SUPPORT)
 
+// number of vendor properties, must currently be 1.
+#define MAX_VENDOR_PROPERTY                 (1)
 
 //***********************************************
 // Enable VENDOR_PERMANENT_AUTH_HANDLE?
@@ -223,4 +222,11 @@
 // (external-NV-specific) attributes are supported.
 #define EXTERNAL_NV                           YES
 
+//***********************************************
+// Defines controlling secure channel functionality
+//***********************************************
+// This flag enables support for PolicyTransportSPDM.
+// See CC_PolicyTransportSPDM.
+#define SEC_CHANNEL_SUPPORT                   YES
+
 #endif // _TPM_PROFILE_COMMON_H_

libtcgtpm/deps/TpmConfiguration/TpmConfiguration/TpmProfile_ErrorCodes.h

@@ -42,6 +42,10 @@
 
 // Additional error codes defined by TPM library:
 #define FATAL_ERROR_ASSERT           (500)
+#define FATAL_ERROR_NV_INIT          (501)
+#define FATAL_ERROR_CRYPTO_INIT      (502)
+#define FATAL_ERROR_NO_INIT          (503)
+
 // Platform library violated interface contract.
 #define FATAL_ERROR_PLATFORM         (600)
 

libtcgtpm/deps/TpmConfiguration/TpmConfiguration/VendorCommands/CommandAttributeData_s_ccAttr.inl

@@ -0,0 +1,16 @@
+// This file contains an inlined portion of the s_ccAttr array definition
+// for vendor commands.
+//
+// IMPORTANT:  This file is included in the middle of an array initializer
+// therefore it must not contain anything other than comments and exactly one TPMA_CC
+// entry per vendor command.  See the private Tpm header CommandAttributeData.h for
+// more info.
+// (This is why the file has the .INL extension, it's not a normal header.
+//
+#ifndef _COMMAND_CODE_ATTRIBUTES_
+#  error This file should be included only within CommandAttributeData.h
+#endif
+#if (PAD_LIST || CC_Vendor_TCG_Test)
+// TPM_CC_Vendor_TCG_Test
+TPMA_CC_INITIALIZER(0x0000, 0, 0, 0, 0, 0, 0, 1, 0),
+#endif

libtcgtpm/deps/TpmConfiguration/TpmConfiguration/VendorCommands/CommandAttributeData_s_commandAttributes.inl

@@ -0,0 +1,16 @@
+// This file contains an inlined portion of the s_commandAttributes array
+// definition for vendor commands.
+//
+// IMPORTANT:  This file is included in the middle of an array initializer
+// therefore it must not contain anything other than comments and exactly one
+// COMMAND_ATTRIBUTES entry per vendor command.  See the private Tpm header
+// CommandAttributeData.h for more info. (This is why the file has the .INL
+// extension, it's not a normal header.
+//
+#ifndef _COMMAND_CODE_ATTRIBUTES_
+#  error This file should be included only within CommandAttributeData.h
+#endif
+#if (PAD_LIST || CC_Vendor_TCG_Test)
+(COMMAND_ATTRIBUTES)(CC_Vendor_TCG_Test*  // 0x0000
+                     (DECRYPT_2 + ENCRYPT_2)),
+#endif

libtcgtpm/deps/TpmConfiguration/TpmConfiguration/VendorCommands/CommandDispatchData_CommandStructures.inl

@@ -0,0 +1,41 @@
+// This file contains an inlined portion of the s_ccAttr array definition
+// for vendor commands.
+//
+// IMPORTANT:  This file is included in the middle of an array initializer
+// therefore it must not contain anything other than comments and exactly one TPMA_CC
+// entry per vendor command.  See the private Tpm header CommandAttributeData.h for
+// more info.
+// (This is why the file has the .INL extension, it's not a normal header.
+//
+#ifndef _COMMAND_TABLE_DISPATCH_
+#error This file should only be included inside CommandDispatchData.h when table dispatching is turned on.
+#endif
+
+#if CC_Vendor_TCG_Test
+#  include "TpmConfiguration/VendorCommands/prototypes/Vendor_TCG_Test_fp.h"
+
+typedef TPM_RC(Vendor_TCG_Test_Entry)(Vendor_TCG_Test_In*  in,
+                                      Vendor_TCG_Test_Out* out);
+
+typedef const struct
+{
+    Vendor_TCG_Test_Entry* entry;
+    UINT16                 inSize;
+    UINT16                 outSize;
+    UINT16                 offsetOfTypes;
+    BYTE                   types[4];
+} Vendor_TCG_Test_COMMAND_DESCRIPTOR_t;
+
+Vendor_TCG_Test_COMMAND_DESCRIPTOR_t _Vendor_TCG_TestData = {
+    /* entry         */ &TPM2_Vendor_TCG_Test,
+    /* inSize        */ (UINT16)(sizeof(Vendor_TCG_Test_In)),
+    /* outSize       */ (UINT16)(sizeof(Vendor_TCG_Test_Out)),
+    /* offsetOfTypes */ offsetof(Vendor_TCG_Test_COMMAND_DESCRIPTOR_t, types),
+    /* offsets       */  // No parameter offsets
+                         /* types         */
+    {TPM2B_DATA_P_UNMARSHAL, END_OF_LIST, TPM2B_DATA_P_MARSHAL, END_OF_LIST}};
+
+#  define _Vendor_TCG_TestDataAddress (&_Vendor_TCG_TestData)
+#else
+#  define _Vendor_TCG_TestDataAddress 0
+#endif  // CC_Vendor_TCG_Test

libtcgtpm/deps/TpmConfiguration/TpmConfiguration/VendorCommands/CommandDispatchData_s_CommandDataArray.inl

@@ -0,0 +1,15 @@
+// This file contains an inlined portion of the s_ccAttr array definition
+// for vendor commands.
+//
+// IMPORTANT:  This file is included in the middle of an array initializer
+// therefore it must not contain anything other than comments and exactly one TPMA_CC
+// entry per vendor command.  See the private Tpm header CommandAttributeData.h for
+// more info.
+// (This is why the file has the .INL extension, it's not a normal header.
+//
+#ifndef _COMMAND_TABLE_DISPATCH_
+#error This file should only be included inside CommandDispatchData.h when table dispatching is turned on.
+#endif
+#if (PAD_LIST || CC_Vendor_TCG_Test)
+(COMMAND_DESCRIPTOR_t*)_Vendor_TCG_TestDataAddress,
+#endif  // CC_Vendor_TCG_Test