TPM hardware components

Article purpose

TPM is an international standard for a secure cryptoprocessor designed to secure hardware through integrated cryptographic keys.

TPM includes a high security level and a security certification, that is graduated with the evaluation assurance level (EAL).

The purpose of this article is to:

• give an example of a TPM hardware component that might be connected to the different boards
• link these components to the corresponding software framework(s)
• point to the component datasheets
• explain, when necessary, how to configure these components.

Software frameworks

Domain	Peripheral	Software frameworks			Comment
		Cortex-A7 secure (OP-TEE)	Cortex-A7 non-secure (Linux)	Cortex-M4 (STM32Cube)
Security	TPM		TPM Software Stack

STPM4RasPI

Description

The STPM4RasPI is an extension board on which one of ST33TPM12 devices is soldered (see list of possible devices below in this chapter). It could be directly connected on an STM32MP157C-DK2 board.

The ST33TPM12 is based on a 32-bit ARM^® reduced instruction set computing (RISC) processor which provides high cryptographic and general performances. A NESCRYPT crypto-processor is also provided to efficiently support all public key cryptographic algorithms.

With ST33TPM12 devices, ST provides an EAL4+ certified solution embedding a secure cryptoprocessor with dedicated hardware accelerators that improve the global platform security.

Multiples services are available using TPM (mostly in PC and mobile devices):

• Cryptographic keys generation, protection, management and utilization
• Cryptographic device identity
• Secure logging, log-reporting and attestation
• Secure non volatile storage
• Other functions including hashing, random number generator and secure clock

Several use cases are available:

• Platform integrity: the boot process relies on TPM for software integrity and authentication during each boot stage
• Disk encryption: encrypt and decrypt drive using TPM crypto core
• Password protection, ...

The STM33TPM12 is provided with different hardware interfaces:

• I2C : ST33TPM12I2C
• SPI : ST33TPM12SPI
• LPC : ST33TPM12SPI

Support in Linux Kernel

TPM is ready to be used with OpenSTLinux distribution.

The TPM drivers (I2C and SPI) are part of the following kernel driver bindings:

• Documentation/devicetree/bindings/security/tpm/st33zp24-i2c.txt| |}} Documentation/devicetree/bindings/security/tpm/st33zp24-i2c.txt
  
• Documentation/devicetree/bindings/security/tpm/st33zp24-spi.txt| |}} Documentation/devicetree/bindings/security/tpm/st33zp24-spi.txt
  

Source code:

• drivers/char/tpm/st33zp24/i2c.c| |}} drivers/char/tpm/st33zp24/i2c.c
  
• drivers/char/tpm/st33zp24/spi.c| |}} drivers/char/tpm/st33zp24/spi.c
  

TPM support relies on a TCG open source TPM2 Software Stack (TSS).

Support in U-BOOT

TPM is supported with existing uclass of the 'Driver Model'.

• tpm
  • uclass: drivers/tpm/tpm-uclass.c| |}} drivers/tpm/tpm-uclass.c .
  • driver: drivers/tpm/tpm_tis_st33zp24_i2c.c| |}} drivers/tpm/tpm_tis_st33zp24_i2c.c
  • driver: drivers/tpm/tpm_tis_st33zp24_spi.c| |}} drivers/tpm/tpm_tis_st33zp24_spi.c

References

<securetransclude src="ProtectedTemplate:ArticleBasedOnModel" params="Hardware components article model"></securetransclude> <securetransclude src="ProtectedTemplate:PublicationRequestId" params="10092 | 2018-12-18 | BrunoB"></securetransclude>