0

We've a few Pi's, model 2, 3B+ and Zero W all running default Raspbian and with the latest firmware updates as of 25 March '19. All of these have an Infineon TPM 2.0 board attached to the gpio pins configured to use SPI. Config.txt is configured with the loading of the correct overlay and the SPI bus on.

dtparam=spi=on
dtoverlay=tpm-slb9670

On boot we have a script run by systemd to write some data into the TPM. We are using the the Infineon eltt2 tool to access the TPM (we also use Intel's TPM2 tools also, but during boot only eltt2 is used).

On the zero w only, during boot systemd reports that the script fails ( error 2 - invalid argument). We've traced this down to the TPM not being accessible. Using dmesg we get the following:

$dmesg | grep tpm
[ 5.338101] systemd[1]: [/etc/systemd/system/tpm2_measure_eltt2.service:12] Unknown lvalue 'After' in section 'Install'
[ 29.151117] tpm_tis_spi spi0.1: 2.0 TPM (device-id 0x1B, rev-id 16)

Ignore the error from systemd, it was only because of this error that we discovered that systemd is trying to run the script before the tpm device driver gets loaded by the kernel.

So basically what seems to be happening is that the TPM device driver doesn't get started until much later in the boot sequence (and thus does not send the startup command to the TPM). After login the script to access the TPM runs perfectly.

Any help appreciated at this stage. Note, this affects the zero w only.

  • 1
    you possibly need to change the after or requires (assuming you've created a systemd service) - with so little actual information about the "script" you "have", it's hard to say – Jaromanda X Mar 26 at 8:54
  • The systemd script is little more than which bash script to execute and the WantedBy statement which works fine on the other models. The script referred to by the ExecStart is a simple bash script containing an instruction to write to one of the TPM's PCR registers using the (Infineon) eltt2 command. There's nothing more than that really, other than the configuration in config.txt. As I said, this works on the other PI models but not the Zero which is where I'm wondering what is actually happening here. – user3166273 Mar 26 at 9:05
  • pi2 and 3b+ are faster, so perhaps the timing is fortuitous with them - I dont' suppose there's any unit/service you can "requires" in your service is there? – Jaromanda X Mar 26 at 9:45
  • or maybe your script can wait until /dev/tpm0 exists before continuing – Jaromanda X Mar 26 at 9:50
  • waiting for a device to exist can be achieved in systemd too ... lists.fedoraproject.org/pipermail/devel/2012-January/… - oops, never mind, that's for USB device – Jaromanda X Mar 26 at 9:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.