Implement support for wolfHAL I2C/SPI backends

[AlexLanzano]

Add wolfHAL support

Adds a wolfHAL IO backend so wolfTPM can talk to a TPM over SPI or I2C on
targets using wolfHAL for peripheral access.

Usage

./configure --enable-wolfhal            # SPI
./configure --enable-wolfhal --enable-i2c   # I2C

Board definitions

wolfTPM does not ship board definitions. tpm_io_wolfhal.c includes
"board.h", which the application provides. A wolfHAL project already has
one, so usually only the TPM entries need adding:

Macro	Bus	Type
BOARD_SPI_DEV	SPI	whal_Spi*
BOARD_SPI_COM_CFG	SPI	whal_Spi_ComCfg*
BOARD_GPIO_DEV	SPI	whal_Gpio* (chip select)
BOARD_CS_PIN	SPI	pin number, active low
BOARD_I2C_DEV	I2C	whal_I2c*
BOARD_I2C_COM_CFG	I2C	whal_I2c_ComCfg* (carries the TPM address)

A missing entry is reported at compile time, naming the macro required.
See hal/README.md for details and examples.

[Copilot]

Pull request overview

Adds a new wolfHAL-based IO backend so wolfTPM can communicate with a TPM over SPI or I2C on targets that use wolfHAL for peripheral access. This fits into the existing hal/ example callback framework and extends the build system and docs to expose the new backend as a selectable option.

Changes:

• Add hal/tpm_io_wolfhal.c implementing SPI and I2C IO callbacks using wolfHAL and application-provided board.h definitions.
• Wire wolfHAL into the HAL selection chain and public HAL prototypes (hal/tpm_io.c, hal/tpm_io.h).
• Expose --enable-wolfhal in configure.ac and document usage/requirements in the root README and hal/README.md.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Documents wolfHAL as a supported platform and adds --enable-wolfhal configuration flag details.
hal/tpm_io.h	Adds wolfHAL callback prototypes for SPI and I2C builds.
hal/tpm_io.c	Adds wolfHAL to the platform selection chain and dispatches to wolfHAL callbacks.
hal/tpm_io_wolfhal.c	New wolfHAL SPI/I2C backend implementation relying on application board.h macros.
hal/README.md	Adds wolfHAL section explaining enablement and required BOARD_* definitions with examples.
hal/include.am	Adds the new source file to the HAL build sources.
configure.ac	Adds --enable-wolfhal option and includes it in the configure summary output.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #562

Scan targets checked: wolftpm-bugs, wolftpm-src

No new issues found in the changed files. ✅

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #562

Scan targets checked: wolftpm-bugs, wolftpm-src

Findings: 4
4 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Suppressed comments (4)

hal/tpm_io_wolfhal.c:105

• XSLEEP_MS(1) is executed even when the transfer succeeds on the first attempt, adding avoidable latency to every successful I2C transaction. Move the sleep so it only occurs when status != WHAL_SUCCESS (and you intend to retry).

        do {
            if (isRead) {
                status = whal_I2c_ReadReg(BOARD_I2C_DEV, reg, buf, size);
            }
            else {
                status = whal_I2c_WriteReg(BOARD_I2C_DEV, reg, buf, size);
            }
            XSLEEP_MS(1);
        } while (status != WHAL_SUCCESS && --tries > 0);

hal/tpm_io_wolfhal.c:246

• CS is released after whal_Spi_EndCom(). It’s generally safer to deassert chip select before tearing down the SPI session to avoid leaving the TPM selected while the SPI peripheral is being shut down (and to better match typical SPI bus semantics). Consider switching the order to release CS first, while still attempting both teardown steps and preserving the first failure reason.

        status = whal_Spi_EndCom(BOARD_SPI_DEV);
        if (status != WHAL_SUCCESS) {
        #ifdef WOLFTPM_DEBUG_VERBOSE
            printf("SPI EndCom Failed: Status=%d\n", status);
        #endif
            ret = TPM_RC_FAILURE;
        }
        status = whal_Gpio_Set(BOARD_GPIO_DEV, BOARD_CS_PIN, 1);
        if (status != WHAL_SUCCESS) {
        #ifdef WOLFTPM_DEBUG_VERBOSE
            printf("SPI CS release Failed: Status=%d\n", status);
        #endif
            ret = TPM_RC_FAILURE;
        }

hal/README.md:35

• This statement is a bit too strong given the implementation/CI behavior: on platforms where another backend wins the selection chain (e.g., Linux), --enable-wolfhal can still build without wolfHAL headers because tpm_io_wolfhal.c compiles to an empty TU. Consider clarifying that wolfHAL headers (and board.h) are required when the wolfHAL backend is actually selected/compiled in (typically bare-metal / non-Linux builds).

Enabled with `WOLFTPM_WOLFHAL` or `--enable-wolfhal`. Requires the wolfHAL
headers on the include path.

.github/workflows/wolfhal-build.yml:38

• The workflow checks out wolfHAL using a floating branch (ref: main), which can make CI non-reproducible and cause unrelated future wolfHAL changes to break this repo’s builds. Pin to a specific commit SHA (or a version tag) to stabilize CI.

          repository: wolfSSL/wolfHAL
          ref: main