OPTIGA™ TPM Forum Discussions
I know there is a solution for this issue. However, it seems there is a dead link in the solution.
Here is the original post.
I was only able to apply one of the recommended patches. That was: https://patchwork.kernel.org/project/linux-integrity/patch/20220321090924.1951-1-johannes.holland@infineon.com/
The other link what was given had no patch. Could someone reply with updated links for the patches I need to apply.
THanks..
-Enrique
------
Kernel Message:
[ 1.049571] tpm_i2c_infineon 3-002e: could not request locality
Show Less
Hi @sneha_prahalad ,
Sorry for the late response on this post(https://community.infineon.com/t5/OPTIGA-TPM/TPM-SLB9672-can-not-read-the-device-id-on-Linux5-10/m-p/453596#M545)
Can I ask why recommend our to fix schematic like below:
Because we afraid if we fix our schematic,maybe have the some side effect.
Here are some recommendations for your schematic:
Pins 1,8 & 14: Place 1uF from VDD_3V3 to GND, and place 0.1uF close to each TPM VDD pin. So, 2x0.1uF are good enough.
Pin 13: It would be better if you removed R502
Pin 18 & 20: Please add a 10K pull-up resistor in Pin20 CS#
在TPM1.2上使用tpm-luks工具成功实现过,但现在换了TPM2.0。
硬件为:thinkpad x1 carbon,安装ubuntu16.04系统时硬盘分区如下:
1、efi分区 1000MB;2、ext4分区 2000MB 挂载到/boot,不加密;3、ext4分区 20G 挂载到/,使用luks加密并设置好密码。
这样每次开机时输入设置的密码能够正常进入系统,现在需要将这个密码存储到TPM2.0芯片中,以实现开机自动解锁和挂载分区3。
我参考了github上的以下几个教程:
1、http://github.com/vchatterji/tpm2-luks //主要教程
2、http://github.com/intel/tpm2-tss
3、http://github.com/intel/tpm2-abrmd
4、http://github.com/intel/tpm2-tools
5、http://github.com/WindRiver-OpenSourceLabs/cryptfs-tpm2 //2、3、4是安装cryptfs-tpm2前需要安装的环境
tpm2-tss、tpm2-abrmd、tpm2-tools已成功安装,但安装cryptfs-tpm2时,执行make命令报如下错误:(环境变量什么的均按教程5里的配置好)
tpm2_rc.h:73:25: error: unknown type name 'TPM2_RC'
问题:是否一定要用到cryptfs-tpm2这个工具?如果不使用cryptfs-tpm2,有没有其它更简单的办法或工具/脚本可以实现将密码存储到tpm2.0芯片中?
Hi ,
I am having TPM2.0 SLB 9670 on my board. I am getting the below error during start-up, related to TPM.
#dmesg | grep tpm
[ 12.222709] tpm_tis_spi spi1.0: 2.0 TPM (device-id 0x1B, rev-id 22)
[ 12.231609] tpm tpm0: A TPM error (256) occurred attempting the self test
[ 12.239298] tpm tpm0: starting up the TPM manually
Could you please let me know how to fix this error?
DTS:
&ecspi2 {
pinctrl-names = "default";
pinctrl-0 = <&pinctrl_ecspi2>, <&pinctrl_spi2_ss0>;
cs-gpios = <&gpio5 13 0>;
status = "okay";
tpm0: slb9670@0 {
compatible = "infineon,slb9670";
reg = <0>;
spi-max-frequency = <38000000>;
};
};
Defconfig changes
# zcat /proc/config.gz | grep TIS
CONFIG_TCG_TIS_CORE=m
# CONFIG_TCG_TIS is not set
CONFIG_TCG_TIS_SPI=m
# CONFIG_TCG_TIS_SPI_CR50 is not set
# CONFIG_TCG_TIS_I2C_CR50 is not set
# CONFIG_TCG_TIS_I2C_ATMEL is not set
# CONFIG_TCG_TIS_I2C_INFINEON is not set
# CONFIG_TCG_TIS_I2C_NUVOTON is not set
# CONFIG_TCG_TIS_ST33ZP24_I2C is not set
# CONFIG_TCG_TIS_ST33ZP24_SPI is not set
Running YOCTO4.0 Linux kernel 5.15.71-lts
Show LessI want porting TPM SLB9672 on my custom board through the SPI, I have been porting SLB9670 on my custom board,It's work,but SLB9672 can not work when using the same step.I know SLB9670 and SLB9672 used the same driver,but I can not get any information from TPM, What should I do?
Show LessHi, I am using below TPM Module
TPM Device
Vendor ID: IFX
Specification Version: 2.0
Firmware Revision: 13.11
Description: INFINEON
Characteristics:
Family configurable via platform software support
OEM-specific Information: 0x00000000
I want to add support IMA in my kernel 5.10. After enabled the below config flags:
CONFIG_INTEGRITY=y CONFIG_IMA=y CONFIG_IMA_MEASURE_PCR_IDX=10 CONFIG_IMA_LSM_RULES=y CONFIG_INTEGRITY_SIGNATURE=y CONFIG_IMA_APPRAISE=y
I can see only one entry in PCR 10.
root@nikhil:~# cat /sys/kernel/security/ima/ascii_runtime_measurements
10 c1091b621b64546f90b059727f0ab1a08a257a71 ima-ng sha1:d5fbd75caeed26c1662f08139ee831cf807af34c boot_aggregate
root@nikhil:~#
Also I am not sure apart from these config flags what things i need to do to get all the IMA functionality.
Can someone please suggest me what wrong here.
Thanks,
Nikhil
Show LessHi,
I'm using SLB 9672 chip in my product. In the chip three gpio pins are there for external usage. SLB 9672 is connected to my board through spi interface.
My case i have connected some external signal in the tpm chip gpio pin, the pin state either high/low. I want to read the Gpio pin state.
How can i read the gpio pin value/state (low/high)??
I have seen a document in that it was mentioned we can access to NV memory through tpm2_nvread, i this case what is the NV address to read GPIO_0, GPIO_1 and GPIO_2. Or any other method is there to read the gpio pin.e
Please share the command or code to read the gpio pin status.
Show Less
I am using SLB9670 TPM Module in Jetson AGX Xavier with ubuntu Linux. IRIDIUM SLB9670 TPM 2.1 evaluation module is working fine with Jetson AGX EVM.
In Target Board, TPM is not detected by ubuntu.
"sudo dmesg | grep tpm" returns blank output. PIRQ pin in TARGET board is connected with different GPIO (GPIO 23).
Linux device tree file is updated as below.
slb9670@0 {
compatible = "tcg,tpm_tis-spi";
reg = <0x00>;
#address-cells = <0x01>;
#size-cells = <0x00>;
spi-max-frequency = <0x4c4b40>;
status = "okay";
controller-data {
nvidia,enable-hw-based-cs;
};
Show Less
Hi,
I am using OPTIGA TPM 9673 RPI EVAL(mounted on top of 40 pin header of RPi 4) for one of my projects. But I am not sure which python library I should use in order to communicate (generate key pair, store PK, retrieve stored key etc) with OPTIGA TPM 9673 RPI EVAL. As of now I tried with tpm2_pytss python binding and also tried TPM commands(tpm2_createprimary, tpm2_create, tpm2_load etc) using sub-process. With TPM commands I was able to see keypair generation is happening but not sure those are generated by my TPM module(Optiga TPM SLB 9673). Output looks as below.
name-alg:
value: sha256
raw: 0xb
attributes:
value: fixedtpm|fixedparent|sensitivedataorigin|userwithauth|restricted|decrypt
raw: 0x30072
type:
value: rsa
raw: 0x1
exponent: 65537
bits: 2048
scheme:
value: null
raw: 0x10
scheme-halg:
value: (null)
raw: 0x0
sym-alg:
value: aes
raw: 0x6
sym-mode:
value: cfb
raw: 0x43
sym-keybits: 128
rsa: cefed6b0621bf8bb1e611d0a655caf9d4c64cf67a52b2c18920684633559023bc74995c879076c7d75c10458975fcf0d03ec5ab5c449fdba0c96c4d8dc8be8d81e59a1cfa9763cf13233f2b4db3664f5f1f3cc1679f4cda18e478011aaadad77ac802290ebe096175d7655aefc7f290a279c06d45b8cde899a1785fe1290976d8e4d6cd7beccbe5869eb12bd6793acf775eff2843530818b098ed4a93a0e3f0e459ad6a2842fff3cff31f3ae1ecd0fb214143b0f7d7b180668c33906d5dcf4c604247baa235685ce393283830a92cf9cb5b9f74b23dbb07dfe95bece89b8e9ed32ff73828b108bdf801fc09eccbf8c0ce15d57b047134a4dffc17f940ae15e61
But when I tried to send TPM commands using command packets using smbus I am getting following error.
Traceback (most recent call last):
File "/home/pi/vade-rpi-prj/./vade-rpi-main.py", line 237, in <module>
tpm_ins.open_tpm_connection()
File "/home/pi/vade-rpi-prj/./vade-rpi-main.py", line 124, in open_tpm_connection
self.i2c.write_byte(self.tpm_address, 0x00)
OSError: [Errno 16] Device or resource busy
Can some one tell what could be the problem for this resource busy? Here I have mounted TPM module on 40 pin RPi header and I have connected my gps module to RPi via usb interface. Also please suggest the right library or tools I should use for writing a python application.
I tried to verify the process or modules that cause conflicts on tpm or i2c. Sharing those outputs as well for getting clear picture.
pi@pi:~/vade-rpi-prj $ ls -l /dev/tpm*
crw-rw---- 1 tss root 10, 224 Jun 27 13:54 /dev/tpm0
crw-rw---- 1 tss tss 237, 65536 Jun 27 13:54 /dev/tpmrm0
pi@pi:~/vade-rpi-prj $
pi@pi:~/vade-rpi-prj $
pi@pi:~/vade-rpi-prj $
pi@pi:~/vade-rpi-prj $ ls -la /dev/i2c*
crw-rw---- 1 root i2c 89, 20 Jun 27 13:54 /dev/i2c-20
crw-rw---- 1 root i2c 89, 21 Jun 27 13:54 /dev/i2c-21
crw-rw---- 1 root i2c 89, 22 Jun 27 13:54 /dev/i2c-22
pi@pi:~/vade-rpi-prj $
pi@pi:~/vade-rpi-prj $
pi@pi:~/vade-rpi-prj $ sudo lsof /dev/tpm*
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
Output information may be incomplete.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
tpm2-abrm 503 tss 6u CHR 10,224 0t0 442 /dev/tpm0
Thanks
Vipin Das
Show LessHi all,
I am working on a project where I interfaced OPTIGA TPM 9673 RPI EVAL with Raspberry pi 4 connected via i2c. SDA/SCL(29/30 pin) from OPTIGA TPM 9673 RPI EVAL is connected to SDA/SCL(3/5 pin) of RPi 4. I powered the OPTIGA TPM 9673 RPI EVAL and tried to verify the TPM module and I could see "
i2c_bcm2835 20480 0" when I run 'lsmod | grep i2c'. Also after loading the i2c-dev, I could see i2c-1 is being available in /dev.
I use Ubuntu Server: 6.2.0-1004-raspi on my RPi.
1. I could see green led is glowing on OPTIGA TPM 9673 RPI EVAL, how should I ensure i2c is properly connected and enabled?
2. When I tried to run 'sudo i2cdetect -y 1' I get below output.
pi@pi:~$ sudo i2cdetect -y 1
0 1 2 3 4 5 6 7 8 9 a b c d e f
00: -- -- -- -- -- -- -- --
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
50: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
60: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
70: -- -- -- -- -- -- -- --
I understood that OPTIGA TPM 9673 RPI EVAL is not detected on the i2c bus. What should be the possible reason for this and how should I resolve this.
Thanks
Vipin Das
Show Less