ELTT2: A Single Binary for Testing Infineon TPM 2.0 Chips

By Indie Kings | November 1, 2026

Updated November 1, 2026: ELTT2 is Infineon's Embedded Linux TPM Toolbox 2, a single executable for testing, diagnosing and changing the basic state of Infineon TPM 2.0 chips. The official repository has 100 stars, a BSD-3-Clause license, releases from 2017 and a Makefile commit from September 11, 2026.

Image: Infineon TPM 2.0 evaluation board from the ELTT2 README.

What the toolbox does

ELTT2 stands for Embedded Linux TPM Toolbox 2. It is an Infineon repository, not a community fork, and its scope is narrow: test an Infineon TPM 2.0, perform diagnosis and make basic state changes. The README calls it a single-file executable. The repository holds one C source file, one header, a Makefile and a license file, which is about as small as a hardware tool can get.

The requirements are equally narrow. A user needs GCC and a Linux system capable of hosting a TPM. The README says the tool may run on other little-endian hardware and software configurations, but that those combinations have not been tested. It does not support a big-endian CPU. Access to the TPM device usually requires root, and the examples assume the device appears at /dev/tpm0.

The documented test platform is an Infineon TPM 2.0 evaluation board, available from the Hitex webshop as the Iridium 9670. Infineon's TPM 2.0 application note covers the driver setup, including an example for Linux kernel 4.14. A user with a discrete TPM on a Raspberry Pi or an embedded board can follow the same pattern if the driver exposes the device correctly.

The first command in any session is usually a startup. The README's example section says to send TPM2_Startup with ./eltt2 -u before working with the TPM. Sending it twice is also an error, and the troubleshooting section says an error code of 0x100 means the startup is missing or was already sent. That is a useful detail for anyone who has spent time guessing why a TPM command is failing.

The tool talks to the TPM through the Linux driver and prints the response. It is not a firmware updater, and the README does not present it as one. It is also not a vulnerability scanner. It can send raw command bytes, but it does not grade the security of a configuration. The value is in repeatable low-level tests and state changes, not in a dashboard or a score.

That distinction matters because TPM tools are often described as if they all do the same job. A firmware updater writes new code to the TPM. A diagnostic tool reads capabilities, extends PCRs and runs self-tests. ELTT2 is in the second category. Using it on a production machine without understanding the state changes can alter boot measurements or leave the TPM in a state that the operating system does not expect.

The command set

The options are short and mostly map to TPM 2.0 commands. The -u option sends a startup, with clear or state as the type. The -d option sends a shutdown. The -g and -v options read fixed and variable capability values. The -c option reads the TPM clock. Those are the reading and lifecycle commands a developer needs before running anything more destructive.

The hash commands come in two shapes. The -s and -S options hash a limited amount of data in one call, with the limit set by the TPM's maximum input buffer size. The -a and -A options run a hash sequence with start, update and complete commands, which lets the TPM hash an arbitrary amount of data. SHA-1 is the default for the lowercase variants, and SHA-256 has a dedicated uppercase variant. SHA-384 is available through the algorithm argument.

The PCR commands are where the preconditions matter. The -r and -R options read a PCR, with SHA-1, SHA-256 or SHA-384 selected by the option or the algorithm argument. The -e and -E options extend a PCR with a digest. The README limits extension to PCRs 0 through 16 and PCR 23, and the digest must be 20, 32 or 48 bytes depending on the hash. A shorter digest is padded with zeros. The -z option resets a PCR, but only PCR 16 and PCR 23 can be reset.

The -l option allocates a SHA-1, SHA-256 or SHA-384 PCR bank. It requires the platform hierarchy authorization value to be empty, and a TPM reset has to follow before the allocation takes effect. That is a stricter precondition than most of the other commands, and it is one reason the README marks each option with a state symbol. A user who ignores the bracket notation will spend time debugging a command that was never allowed to run.

The -G option returns random bytes, with a maximum of 32 bytes per request. The -t option runs a self-test, either a partial test of previously untested capabilities, a full test or an incremental test of selected algorithms. The -T option reads the result of the last self-test. The -b option is the escape hatch: it sends arbitrary command bytes and prints the response, which is useful when a TPM command is not wrapped by a dedicated option.

The command set is documented in a table with preconditions. A dash means no special state. A star means the platform hierarchy authorization value is empty. An l means the required PCR bank is allocated. A u means the TPM is started. Those symbols are small, but they encode most of the operational knowledge in the README. The tool assumes a user who already knows which state the TPM should be in and wants a direct way to test it.

Who it is for

The audience is firmware and platform engineers, validation labs, embedded Linux developers and anyone bringing up an Infineon TPM 2.0 on a board. The repository is not aimed at a desktop user who wants to check whether Windows 11 will install. It does not walk through BitLocker, measured boot or a vendor's firmware update process. It gives direct access to TPM commands and expects the user to know why they are sending them.

The project's age is a feature and a warning. The first release, Version 1.0, is dated April 10, 2017, and Version 1.1 followed on September 11, 2017. The code has been stable for years, with occasional maintenance such as a September 11, 2026 commit that changed the Makefile to use weak assignments. A stable diagnostic tool is useful. A stable tool with 2017 release notes also means the documentation may not cover newer TPM firmware behavior.

The repository has 4 open issues and 43 forks, which suggests a small but real user base. The license is BSD-3-Clause, so the code can be reused with attribution. The README carries Infineon's copyright notice and points questions to a local Infineon representative rather than a public support queue. That is typical for a vendor tool published on GitHub: the code is available, but the support path is commercial.

The safety advice is simple. Use a test board or a machine you can recover. Do not extend or reset PCRs on a production system unless you understand which boot measurements depend on them. Do not allocate or clear a PCR bank on a machine whose disk encryption is tied to the current measurements. And do not treat a successful command response as proof that the TPM is healthy. ELTT2 reports what the TPM says, not what the platform should do.

The tool is also a useful reference for the command layer. A developer writing a custom TPM test can compare the option mapping, the preconditions and the error messages against a known vendor implementation. That is a quieter value than a headline feature, but it is the reason a nine-year-old repository still gets maintenance commits.

Command card

Option	What it does	Precondition
-u	Sends TPM2_Startup, with clear or state as the type	None
-g and -v	Reads fixed and variable capability values	TPM started
-r and -R	Reads a SHA-1, SHA-256 or SHA-384 PCR	Started and PCR bank allocated
-e and -E	Extends PCRs 0 to 16 and PCR 23 with a digest	Started and PCR bank allocated
-G	Returns up to 32 random bytes	TPM started
-b	Sends raw TPM command bytes and prints the response	TPM started
-t and -T	Runs a self-test and reads the result	TPM started
-l	Allocates a SHA-1, SHA-256 or SHA-384 PCR bank	Started and empty platform authorization

FAQ

What is ELTT2?
Infineon's Embedded Linux TPM Toolbox 2, a single executable for testing, diagnosing and making basic state changes to an Infineon TPM 2.0 on Linux. It is published under the Infineon GitHub organization.

Does ELTT2 update TPM firmware?
No. Its documented scope is testing, diagnosis and basic state changes. Firmware updating is handled by Infineon's TPMFactoryUpd tool, which is a separate program with a different command set.

What do I need to run it?
GCC, a Linux system with a TPM device, and root access to that device. The examples assume /dev/tpm0. The README says little-endian systems are supported and big-endian CPUs are not.

Which TPMs does it support?
Infineon TPM 2.0 devices. The documented test platform is the Iridium 9670 evaluation board from Hitex. The tool may work on other little-endian Linux systems with a TPM, but those combinations have not been tested by Infineon.

What does the -b option do?
It sends arbitrary TPM command bytes and prints the response. It is useful for commands that do not have a dedicated ELTT2 option, but it also lets a user send invalid or destructive commands, so the state of the TPM matters.

Is it safe on a production machine?
Not without care. PCR extend and reset change boot measurements, and allocating a PCR bank requires a TPM reset to take effect. Use a test board or a recoverable machine unless you understand the platform's measured boot configuration.

Bottom Line

ELTT2 is a small, official Infineon tool for talking to TPM 2.0 hardware on Linux. It reads capabilities and PCRs, extends and resets selected PCRs, runs self-tests, returns random bytes and can send raw commands. It needs GCC, a TPM device and root, and it is built for little-endian systems. The repository has 100 stars, 43 forks, 4 open issues, a BSD-3-Clause license and releases from 2017, with a maintenance commit in September 2026.

Our take: this is a bench tool, not a consumer utility. Its value is that it exposes the TPM command layer without a large framework, and its risk is the same thing. If you need to test an Infineon TPM 2.0, it is a direct route. If you need to update firmware or check whether a PC is ready for Windows 11, it is the wrong tool.

Sources

GitHub Infineon/eltt2 README, prerequisites, usage, command table, examples, FAQ and troubleshooting, accessed November 1, 2026
GitHub Infineon/eltt2 releases Version_1.0 and Version_1.1, release dates and notes, accessed November 1, 2026
GitHub API metadata for Infineon/eltt2, stars, forks, issues, creation date, last push and license, accessed November 1, 2026
GitHub commit c8c472bd, Use weak assignments in Makefile, September 11, 2026