2

I have a Raspberry Pi with a TPM chip, where I use the TPM for disk encryption. The disk encryption password is sealed to the TPM using PCR register 0. I extend the PCR on the start of the system with certain values, but I found out that PCR 0 only resets on a power cycle, and not on a reboot.

Also running tpm2_shutdown --clear && tpm2_startup --clear does not reset the value, while the TPM spec states the following:

TPM Reset is a Startup(CLEAR) that follows a Shutdown(CLEAR), or a Startup(CLEAR) for which there was no preceding Shutdown() (that is, a disorderly shutdown). A TPM Reset is roughly analogous to a reboot of a platform. As with a reboot, most values are placed in a default initial state, but persistent values are retained. Any value that is not required by this specification to be kept in NV memory is reinitialized. In some cases, this means that values are cleared, in others it means that new random values are selected.

How can I reset PCR 0 on a reboot?

The TPM is connected by a in-house made PCB, so it could be a hardware-connection problem.

Improve this question
1
  • What is the manufacturer of TPM? Some manufacturers do not allow resetting PCR 0-15 due to been part of SRTM.
    – saurabh
    Jan 24 at 11:30

1 Answer 1

Reset to default
1

It turned out I needed the use the physical reset PIN of the TPM-chip. I found the information in the datasheet. The chip I have is the Infineon SLB9670VQ20FW785XTMA1.

Table 3 in the datasheet describes that the RST# pin is typically connected to the PCIRST# signal of the host. I'm not 100% sure, but I think this is triggered by a reboot.

My Raspberry Pi does not have a PCIRST# signal, but had the reset pin connected to pin 19. I solved the issue by executing gpio 19 out 0 on shutdown. Meaning that GPIO pin 19 is put on low, triggering a reset. Optionally I could set the pin to high on boot, but it works like this.

Improve this answer
3
  • 1
    Do your security properties rely on the reset being done on shutdown? If so, it should be done in hardware, not software. E.g. keep the RST# pin normally low until the CPU pull it up.
    – billc.cn
    Jan 24 at 14:12
  • I know that would be better to do it with hardware, but the TPM is placed on a PCB that is connected to a Raspberry Pi Compute Module, and I can't just change the PCB. But if you know a pin on the Compute Module that has about the same functionality as the PCIRST# signal, we could use it in a future version.
    – Jan Wytze
    Jan 24 at 14:39
  • Sorry, I'm not really a hardware guy, found out that the Compute Module spec does include the PCIe_nRST pin.
    – Jan Wytze
    Jan 26 at 9:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .