Hi,

There is a tpm device SLM9670 connected to NXP CPU with SPI bus on my board. The running linux version is 4.14. spi mode is 0.

From tpm_tis_core driver tpm startup, SPI master send 0x80-0xd4-0x0-0x0 to SLM9670, SLM9670 responses 0x0-0x0-0x0-0x1 at first transaction, then TPM ACCESS VALID(0x80) at second transaction.

But on my board, SLM9670 response 0x0-0x0-0x0-0x1. then 0x0. Could you please tell me why SLM9670 cannot response TPM ACCESS VALID?  thanks.

Please see the SPI bus waves captured by probe.

red: SCK

yellow: MOSI

blue: MISO

Hi, I have integrated the TPM 2.0 Iridium SLB 9670 together with the i.MX8MP processor to implement remote attestation using the IMA Linux kernel module. Sometimes I get strange this error "tpm tpm0: invalid TPM_STS.x 0xa8 " that I cannot find a solution online. As I understand it I should get 0xff in case there are transmission calls to tpm that are not protected by the tpm_try_get_ops command. Checking the Linux kernel however it is indeed called and in fact, the value is not 0xff but is variable. On a couple of other occasions, however, it has failed to even establish the initial connection ('2.0 TPM (device-id 0x1B, rev-id 22') and some debugging showed that the tpm spi driver was stuck in an infinite loop waiting for the TPM locality. The wiring is correct, in fact, if the tpm connects without errors, the tpm2tools commands work. The device tree is correct because I asked for confirmation on the NXP forum. I also tried replacing the tpm but got the same result. I currently I'm using Linux kernel 5.15.60 but I get the same error using the i.MX6UL board which has kernel 5.10.60. What caused this error?

The output of dmesg | grep -i tpm

[ 2.077539] tpm_tis_spi spi1.0: 2.0 TPM (device-id 0x1B, rev-id 22)

[ 2.088911] tpm tpm0: A TPM error (256) occurred attempting the self test

[ 2.095719] tpm tpm0: starting up the TPM manually

[ 12.489312] tpm tpm0: tpm_try_transmit: send(): error -5

[ 38.235405] tpm tpm0: tpm_transmit: tpm_recv: error -52

[ 38.284794] tpm tpm0: invalid TPM_STS.x 0x85, dumping stack for forensics

[ 38.284861] tpm_tis_status+0xc8/0xe4

[ 38.284869] wait_for_tpm_stat+0x54/0x224

[ 38.284878] tpm_tis_send_data+0x220/0x28c

[ 38.284886] tpm_tis_send_main+0x34/0x110

[ 38.284893] tpm_tis_send+0x44/0x110

[ 38.284901] tpm_transmit+0xc8/0x340

[ 38.284908] tpm_transmit_cmd+0x30/0xc0

[ 38.284914] tpm2_pcr_extend+0x25c/0x300

[ 38.284921] tpm_pcr_extend+0xc4/0xd4

I have both SLB9670 and SLB9672.

SLB9670 supports only SHA1 and SHA256. SLB9672 supports SHA1, SHA256 and SHA384.

I tried to enable all the SHA banks in SLB9670, and it is working fine. When I dump PCRs using tpm2_pcrread, I see 24 PCRs for each algorithm.

But when I tried to enable all the SHA algorithms in SLB9672, I'm able to enable only one algorithm at anytime.

When I try to Pcr_Allocate other algorithms, the call is failing with response code: 0x127 which means TPM_RC_PCR. Not sure what this really means.

The datasheet of both modules(SLB9670 & SLB9672) mentions that it has 24PCRs. There is no PCR bank information mentioned in the datasheet. Please help to clarify whether SLB9672 has only 1 bank or 3 banks.

I have both SLB9670 and SLB9672.

SLB9670 supports only SHA1 and SHA256. SLB9672 supports SHA1, SHA256 and SHA384.

I tried to enable all the SHA banks in SLB9670, and it is working fine. When I dump PCRs using tpm2_pcrread, I see 24 PCRs for each algorithm.

[root@sut]# tpm2_pcrread
sha1:
0 : 0x82058CB8F75B27148FD1C819B892E329E2CF33D2
1 : 0xAE784ECE98E530668A79D42FD8F2A3AA45F72971
2 : 0xBEE5FCDF336368AA1546107513D7F512F38242D3
3 : 0xB2A83B0EBF2F8374299A5B2BDFC31EA955AD7236
4 : 0xB46CB5175855A91C937DEDA0E4AA9EB1BA2F0D4B
5 : 0x3532CBD8F210D069FD5FFA0FB95511212D78300D
6 : 0xB2A83B0EBF2F8374299A5B2BDFC31EA955AD7236
7 : 0x7679047866E616450760CE711EA91126EB45BEF6
8 : 0x0000000000000000000000000000000000000000
9 : 0x0000000000000000000000000000000000000000
10: 0x48CF6F111AA5EF8951DAFD528E52260FE375D6D0
11: 0x0000000000000000000000000000000000000000
12: 0x0000000000000000000000000000000000000000
13: 0x0000000000000000000000000000000000000000
14: 0xD93FF8609F4C858F0000E25E016C820AA1EA2C31
15: 0x0000000000000000000000000000000000000000
16: 0x0000000000000000000000000000000000000000
17: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
18: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
19: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
20: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
21: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
22: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
23: 0x0000000000000000000000000000000000000000
sha256:
0 : 0xC819CEE938B32ACAA123B7F8F72572725173E2CCE2E6832D573542947C5784CE
1 : 0x3179162CF8BF0901D8483680C1F2ED2E40EC1BD671F04BF804AE040652F4B8DB
2 : 0x5E8098A75C2B826F2AB14F4DBABA5DB0F7004679133829F999C97DBA6FF480C7
3 : 0x3D458CFE55CC03EA1F443F1562BEEC8DF51C75E14A9FCF9A7234A13F198E7969
4 : 0x0B540F0839930723AF23F0F5F9A51AE0BD93C902C5BC3E2E0A73F0659FC0BB9C
5 : 0x79FC5E73AAB8BA4CB31750FBA791040AB26A3B76504009842136F40961FFCC96
6 : 0x3D458CFE55CC03EA1F443F1562BEEC8DF51C75E14A9FCF9A7234A13F198E7969
7 : 0xB926225AC488E9C50EF2FA815AA7104B385A06907093BFB1DC62EEB7ABECDDF1
8 : 0x0000000000000000000000000000000000000000000000000000000000000000
9 : 0x0000000000000000000000000000000000000000000000000000000000000000
10: 0xDC7CE7DC066DD21C556FA3215154CF8322CAF212A47E837219DB5EFC0B140344
11: 0x0000000000000000000000000000000000000000000000000000000000000000
12: 0x0000000000000000000000000000000000000000000000000000000000000000
13: 0x0000000000000000000000000000000000000000000000000000000000000000
14: 0xE2D3F225DE80E60D3D29DB95DFE9D66500A21331C08914F90EE96602A96FA595
15: 0x0000000000000000000000000000000000000000000000000000000000000000
16: 0x0000000000000000000000000000000000000000000000000000000000000000
17: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
18: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
19: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
20: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
21: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
22: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
23: 0x0000000000000000000000000000000000000000000000000000000000000000

But when I tried to enable all the SHA algorithms in SLB9672, I'm able to enable only one algorithm at anytime.

When I try to Pcr_Allocate other algorithms, the call is failing with response code: 0x127 which means TPM_RC_PCR. Not sure what this really means.

The datasheet of both modules(SLB9670 & SLB9672) mentions that it has 24PCRs. There is no PCR bank information mentioned in the datasheet. Please help to clarify whether SLB9672 has only 1 bank or 3 banks.

I have both SLB9670 and SLB9672.

SLB9670 supports only SHA1 and SHA256. SLB9672 supports SHA1, SHA256 and SHA384.

I tried to enable all the SHA banks in SLB9670, and it is working fine. When I dump PCRs using tpm2_pcrread, I see 24 PCRs for each algorithm.

[root@sut11sys-r242 ~]# tpm2_pcrread
sha1:
0 : 0x82058CB8F75B27148FD1C819B892E329E2CF33D2
1 : 0xAE784ECE98E530668A79D42FD8F2A3AA45F72971
2 : 0xBEE5FCDF336368AA1546107513D7F512F38242D3
3 : 0xB2A83B0EBF2F8374299A5B2BDFC31EA955AD7236
4 : 0xB46CB5175855A91C937DEDA0E4AA9EB1BA2F0D4B
5 : 0x3532CBD8F210D069FD5FFA0FB95511212D78300D
6 : 0xB2A83B0EBF2F8374299A5B2BDFC31EA955AD7236
7 : 0x7679047866E616450760CE711EA91126EB45BEF6
8 : 0x0000000000000000000000000000000000000000
9 : 0x0000000000000000000000000000000000000000
10: 0x48CF6F111AA5EF8951DAFD528E52260FE375D6D0
11: 0x0000000000000000000000000000000000000000
12: 0x0000000000000000000000000000000000000000
13: 0x0000000000000000000000000000000000000000
14: 0xD93FF8609F4C858F0000E25E016C820AA1EA2C31
15: 0x0000000000000000000000000000000000000000
16: 0x0000000000000000000000000000000000000000
17: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
18: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
19: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
20: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
21: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
22: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
23: 0x0000000000000000000000000000000000000000
sha256:
0 : 0xC819CEE938B32ACAA123B7F8F72572725173E2CCE2E6832D573542947C5784CE
1 : 0x3179162CF8BF0901D8483680C1F2ED2E40EC1BD671F04BF804AE040652F4B8DB
2 : 0x5E8098A75C2B826F2AB14F4DBABA5DB0F7004679133829F999C97DBA6FF480C7
3 : 0x3D458CFE55CC03EA1F443F1562BEEC8DF51C75E14A9FCF9A7234A13F198E7969
4 : 0x0B540F0839930723AF23F0F5F9A51AE0BD93C902C5BC3E2E0A73F0659FC0BB9C
5 : 0x79FC5E73AAB8BA4CB31750FBA791040AB26A3B76504009842136F40961FFCC96
6 : 0x3D458CFE55CC03EA1F443F1562BEEC8DF51C75E14A9FCF9A7234A13F198E7969
7 : 0xB926225AC488E9C50EF2FA815AA7104B385A06907093BFB1DC62EEB7ABECDDF1
8 : 0x0000000000000000000000000000000000000000000000000000000000000000
9 : 0x0000000000000000000000000000000000000000000000000000000000000000
10: 0xDC7CE7DC066DD21C556FA3215154CF8322CAF212A47E837219DB5EFC0B140344
11: 0x0000000000000000000000000000000000000000000000000000000000000000
12: 0x0000000000000000000000000000000000000000000000000000000000000000
13: 0x0000000000000000000000000000000000000000000000000000000000000000
14: 0xE2D3F225DE80E60D3D29DB95DFE9D66500A21331C08914F90EE96602A96FA595
15: 0x0000000000000000000000000000000000000000000000000000000000000000
16: 0x0000000000000000000000000000000000000000000000000000000000000000
17: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
18: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
19: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
20: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
21: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
22: 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
23: 0x0000000000000000000000000000000000000000000000000000000000000000

But when I tried to enable all the SHA algorithms in SLB9672, I'm able to enable only one algorithm at anytime.

When I try to Pcr_Allocate other algorithms, the call is failing with response code: 0x127 which means TPM_RC_PCR. Not sure what this really means.

The datasheet of both modules(SLB9670 & SLB9672) mentions that it has 24PCRs. There is no PCR bank information mentioned in the datasheet. Please help to clarify whether SLB9672 has only 1 bank or 3 banks.

We have many of these Dynabook Portege X30W-J laptops on site, but only one like this. When trying to reimage with Autopilot and finish the white glove setup, provisioning fails with 'TPM attestation timed out'. 

Anyone know what should be done to sort this?

Many thanks for looking.

Running the TPM tool gives the following info:

C:\Windows\system32>tpmtool getdeviceinformation

-TPM Present: True
-TPM Version: 2.0
-TPM Manufacturer ID: IFX
-TPM Manufacturer Full Name: Infineon
-TPM Manufacturer Version: 7.85.4555.0
-PPI Version: 1.3
-Is Initialized: True
-Ready For Storage: True
-Ready For Attestation: False
-Information Flags Description:
INFORMATION_EK_CERTIFICATE
-Is Capable For Attestation: False
-Clear Needed To Recover: False
-Clear Possible: True
-TPM Has Vulnerable Firmware: False
-PCR7 Binding State: 2
-Maintenance Task Complete: True
-TPM Spec Version: 1.38
-TPM Errata Date: Monday, January 08, 2018
-PC Client Version: 1.03
-Is Locked Out: False

Hello, Infineon community, 

I'm trying to find out more about SLB 9665TT2.0 SHA256 and Linux support, hope you can provide some clarity. According to the datasheet, this TPM chip supports 2.0 standards, but there is an issue when using it to create/store/seal  FDE hashes. Detailed background info is logged here.  TL;DR Linux kernel does not recognize SHA256 - although it's there and it thinks only SHA1 is available.  The FW is 5.62, provided by Intel for the NUC5 platform. 

• Does this chip SLB 9665TT2.0 provides SHA256[not a hardware limitation]?
• Which Linux kernel supports it?
• Is there a way to disable SHA1 in favour of SHA256 [ hardware or software ]? 
• Does it need a newer FW 5.63? Where I can find it? 

Any thoughts or experience with this will be much appreciated! 

Kind regards, 

Martin 

I am working with an SLB9670 on a module built to be plugged into an ASRock motherboard.  I'm using the module on a Raspberry Pi (I've manually wired the module to the GPIO on the Pi).  I had success doing this about 6 months ago, but now I am unable to perform any TPM functions.

The wiring is definitely correct (I've checked and re-wired about 20 times), but it seems that the data returned is bad.  Linux is unable to initialize the device when using the Pi's tpm-slb9670 overlay, and manual interaction with the device never seems to return proper data.  I seem to get the bytes "0x00 0x00 0x00 0x01 0x81 0x40 0x00 0x 00 0x01 0x3f", followed by "0xff" repeating until the response length matches the input length, no matter what TPM command I send. I've done power-cycles of the TPM and grounded the reset pin between attempts and no matter what, nothing seems to change.  This has been tested on 3 different host devices with different SPI adapters since the problem started, all with the same results.  See below for examples of different commands and the output.  

It seems like the device is stuck in some bad state or is malfunctioning somehow, but that's just a guess.  I only found one other reference online where someone was getting a similar result (https://www.wolfssl.com/forums/topic1760-wolftpmspigenodeintegration.html) but no solution was provided that addresses my situation.  Any ideas on what's going on and how to remedy? 

>>> #get_capabilities
>>> "".join("%02x " % i for i in spi.xfer(b"\x80\x01\x00\x00\x00\x16\x00\x00\x01\x7a\x00\x00\x00\x06\x00\x00\x01\x02\x00\x00\x00\x01"))
'00 00 00 01 81 40 00 00 01 3f ff ff ff ff ff ff ff ff ff ff ff ff '
>>> #startup
>>> "".join("%02x " % i for i in spi.xfer(b"\x80\x01\x00\x00\x00\x0c\x00\x00\x01\x44\x00\x00"))
'00 00 00 01 81 40 00 00 01 3f ff ff '
>>> #shutdown
>>> "".join("%02x " % i for i in spi.xfer(b"\x80\x01\x00\x00\x00\x0c\x00\x00\x01\x45\x00\x00"))
'00 00 00 01 81 40 00 00 01 3f ff ff '
>>> #clear
>>> "".join("%02x " % i for i in spi.xfer(b"\x80\x02\x00\x00\x00\x1b\x00\x00\x01\x26\x40\x00\x00\x0c\x00\x00\x80\x02\x00\x00\x00\x1b\x00\x00\x01\x26\x40\x00\x00\x0c\x00\x00"))
'00 00 00 01 81 40 00 00 01 3f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff '