Infineon Firmware Updater: A Linux Port for TPM Firmware Flashing

By Indie Kings | November 1, 2026

Updated November 1, 2026: infineon-firmware-updater is a 2021 Linux packaging of Infineon's TPMFactoryUpd, the command-line tool that writes firmware to Infineon TPM chips. It builds from Infineon's source with Chrome OS patches, ships no firmware images and points users to OEM update packages. The repository has 4 stars, no releases and no commits since August 8, 2021.

Image: TPMFactoryUpd overview diagram from the Infineon documentation included in the repository.

What the repo actually is

The name sounds like a new updater. It is not. The repository is a packaging of Infineon's TPMFactoryUpd source for Linux, with patches taken from Chrome OS. The README says so directly: it is an Infineon TPM firmware updater for Linux with Chrome OS patches. The official Infineon Readme.txt, user manual PDF and source documentation are included in the tree.

The source release is TPMFactoryUpd 01.01.2529.00. The README points to the Supermicro archive TPM_FU_v1.01.2529.00_ToolsOnly_Linux_SourceCode.tar.gz as the main source and to the Chromium OS overlay for the patches. It also credits iavael's infineon-firmware-updater repository as part of the inspiration. This is a fork of a vendor tool, not an independent implementation of TPM firmware flashing.

The patch history explains why the fork exists. The commits from August 8, 2021 add Chrome OS patches for retrying a send when the TPM is busy, changing the owner authorization update type, ignoring an error on complete, changing the default password, adding a dry-run option, removing the log file size limit, fixing the Makefile and building against OpenSSL 1.1. Those are the changes that made the vendor source easier to build and use on Linux.

The repository itself is tiny in adoption. It has 4 stars, 0 forks and 0 open issues. There is no license file and no tagged release. The last commit is from August 8, 2021, the same day the repository was created. A reader should treat it as a historical packaging rather than a maintained distribution. The code inside may still work, but nobody is shipping updates for new distributions or new TPM firmware.

It also does not contain firmware. The README links OEM packages for the SLB 965x, SLB 966x and SLB 9670 families, hosted by Supermicro. Infineon's own documentation says firmware images are provided separately and that OEMs often package them inside Windows binaries. The repository gives a user a Linux binary and a list of places to find the firmware, not a firmware archive.

That division is the most important thing to understand before building anything. TPMFactoryUpd is the writer. The firmware image is the payload. The OEM is the source of the payload. A mismatch between the tool, the TPM model and the firmware image can fail at best and leave the TPM unusable at worst.

Building it in 2026

The build command is short: make -C Source/TPMFactoryUpd. The README lists openssl-1.1 as the requirement. That is an old branch. Many current Linux distributions ship OpenSSL 3 by default, so a user may need a compatibility package, a container with an older distribution, or the OpenSSL 1.1 patch that is already in the repository history. The build is not complicated, but it is not a turnkey package for a 2026 desktop.

When the binary runs, it prints a banner with the Infineon copyright and TPMFactoryUpd version 01.01.2529.00. The help screen lists the parameters. The -info option displays TPM information related to firmware update. The -update option selects the update type. The -firmware option names the firmware image. The -config option selects a configuration file for a scripted update. The -log option writes a log, and the -dry-run option does everything except the actual update.

The access mode matters on Linux. The README lists mode 1 as memory-based access, supported only on x86 systems with PCH TPM support, and mode 3 as the Linux TPM driver. The optional path after the mode sets the device, with /dev/tpm0 as the default. A user on a normal Linux machine with a TPM device will usually want mode 3. A user on an embedded board with a different device node needs to pass the correct path.

The update types cover two TPM generations. The tpm12-PP type is for TPM 1.2 with physical presence or deferred physical presence. The tpm12-takeownership type is for TPM 1.2 with ownership taken by TPMFactoryUpd. The tpm20-emptyplatformauth type is for TPM 2.0 with an empty platform authorization value. The config-file type updates either generation to the version named in a configuration file and requires the -config parameter.

Infineon's Readme.txt adds rules that the short README does not. Firmware images are matched to the current firmware version, and the file name indicates the source version and the resulting version. An update must use the image whose source matches the TPM's current firmware. The total number of updates a TPM accepts is limited, and once the limit is reached, no further update is possible. Updating between the TPM 1.2 and TPM 2.0 families resets the TPM to factory defaults.

Those rules are not fine print. A user who grabs the newest firmware file without checking the source version may get a rejection, or worse, a TPM that no longer matches the platform's expectations. A user who crosses the 1.2 and 2.0 families should assume the TPM will be wiped. BitLocker recovery keys, measured boot state and ownership data should be treated as at risk before the command is run.

Firmware, ROCA and risk

The README's HowTo link goes to a 3mdeb article titled How to mitigate ROCA TPM vulnerability? The article describes ROCA as a vulnerability discovered in October 2017 in Infineon's RSALib software library, which is also used in TPM modules. When the flaw is present, the prime numbers used to generate RSA keys come from a small subset of possible primes, which weakens the keys. The article discusses mitigation and testing on Infineon TPMs.

That context explains why firmware updates matter. An affected TPM can generate weak RSA keys, and a firmware update is one of the ways to move a machine to a fixed version. The repository does not diagnose whether a specific TPM is affected, and it does not include a scanner. It provides the updater and points to OEM firmware and a how-to. A user still has to identify the TPM model, the current firmware and the correct update package.

The OEM dependency is the practical bottleneck. The README lists Supermicro packages for the SLB 965x, SLB 966x and SLB 9670 families. Other machines may use the same TPM models with different vendor packaging, or may package the firmware inside a Windows executable with no documented extraction path. Infineon's Readme.txt says firmware images are provided separately and that the number of updates is limited. A user without the right package cannot proceed safely, even with a working Linux binary.

The risk profile is higher than a BIOS setting change. A TPM firmware update writes persistent code to a security chip. A failed update can leave the TPM in a failure mode or unusable. A successful update can reset the TPM to factory defaults, especially when crossing between TPM 1.2 and TPM 2.0. Disk encryption tied to the TPM may then require a recovery key, and measured boot measurements may change. The correct preparation is a recovery key, a vendor-supported firmware package and a machine that can be recovered if the update fails.

The repository's age adds a second risk. The tool was packaged in 2021, and its build instructions assume OpenSSL 1.1. The firmware packages it links may have moved or changed. The absence of a license file also means a user should check Infineon's terms before redistributing the source. None of that makes the tool unusable. It means the user is responsible for the environment, the payload and the recovery plan.

There is also a distinction between this repository and ELTT2, Infineon's TPM test toolbox. ELTT2 tests capabilities, PCRs and state. TPMFactoryUpd writes firmware. They are different tools with different risk. A user who wants to inspect a TPM should not start with the updater, and a user who needs to update firmware should not expect a diagnostic tool to do it.

Command card

Parameter	What it does
-info	Displays TPM information related to firmware update
-update <type>	Selects tpm12-PP, tpm12-takeownership, tpm20-emptyplatformauth or config-file
-firmware <file>	Names the firmware image; required for the tpm12 and tpm20 update types
-config <file>	Names the configuration file; required for the config-file update type
-log [file]	Writes a log, defaulting to TPMFactoryUpd.log
-access-mode <mode> <path>	Mode 3 uses the Linux TPM driver, with /dev/tpm0 as the default path
-dry-run	Does everything except the actual firmware update
-tpm12-clearownership	Clears TPM 1.2 ownership taken by TPMFactoryUpd

FAQ

What is infineon-firmware-updater?
A Linux packaging of Infineon's TPMFactoryUpd source with Chrome OS patches. It builds a command-line tool that updates firmware on Infineon TPM chips. It is not a new updater written from scratch.

Does it include firmware images?
No. The README links OEM packages for the SLB 965x, SLB 966x and SLB 9670 families, hosted by Supermicro. Infineon's documentation says firmware images are provided separately.

How do I use it on Linux?
Build with make -C Source/TPMFactoryUpd, then use -access-mode 3 /dev/tpm0 to select the Linux TPM driver. The -info option reads TPM information and -dry-run tests the procedure without writing firmware.

Can it fix the ROCA vulnerability?
It updates Infineon TPM firmware, and the README points to a 3mdeb article about mitigating ROCA. Whether a specific TPM is affected and whether a given firmware package fixes it depends on the model, the current firmware and the OEM package.

Is it maintained?
No. The last commit is from August 8, 2021, there are no releases, and the build asks for OpenSSL 1.1. Treat it as a historical packaging and expect to solve build and dependency issues yourself.

Is a TPM firmware update safe?
It carries real risk. A failed update can leave the TPM unusable, and a successful update can reset it to factory defaults, especially when crossing between TPM 1.2 and TPM 2.0. Have recovery keys and a vendor-supported package before starting.

Bottom Line

infineon-firmware-updater is a 2021 Linux build of Infineon's TPMFactoryUpd 01.01.2529.00 with Chrome OS patches for busy retries, dry runs, logging, ownership authorization and OpenSSL 1.1. It provides the updater, not the firmware. The README points to OEM packages for the SLB 965x, SLB 966x and SLB 9670 families and to a 3mdeb article on mitigating the ROCA TPM vulnerability. The repository has 4 stars, no releases, no license file and no commits since August 8, 2021.

Our take: this is a useful historical reference for someone who needs to build the vendor tool on Linux, not a recommended first stop for a TPM update. The firmware matching rules and the update limit are the parts that matter, and they live in Infineon's Readme.txt rather than the short README. Read that file, confirm the TPM model and current firmware, and have a recovery plan before running anything.

Sources

GitHub crass/infineon-firmware-updater README, build instructions, firmware links, usage and credits, accessed November 1, 2026
Infineon Readme.txt included in the repository, prerequisites, firmware image rules, compilation, release info and known limitations, accessed November 1, 2026
3mdeb article How to mitigate ROCA TPM vulnerability?, linked from the repository README, accessed November 1, 2026
GitHub API metadata and commit history for crass/infineon-firmware-updater, stars, forks, issues, creation date and Chrome OS patch commits, accessed November 1, 2026