TPM hardware components

1 Article Purpose

TPM is an international standard for a secure cryptoprocessor designed to secure hardware through integrated cryptographic keys.

TPM includes a high security level and a security certification, that is graduated with the evaluation assurance level (EAL).

The purpose of this article is to:

• list the TPM hardware components that might be connected to the different boards
• link these components to the corresponding software framework(s)
• point to the component datasheets
• explain, when necessary, how to configure these components.

2 Software frameworks

Domain	Peripheral	Software frameworks			Comment
		Cortex-A7 secure (OP-TEE)	Cortex-A7 non-secure (Linux)	Cortex-M4 (STM32Cube)
Security	TPM		TPM Software Stack

3 ST33TPM12

3.1 Description

The ST33TPM12 is built on a 32-bit ARMTemplate:Sup reduced instruction set computing (RISC) processor which provides high cryptographic and general performances. A NESCRYPT crypto-processor is also provided to efficiently support all public key cryptographic algorithms.

With ST33TPM12 devices, ST provides an EAL4+ certified solution embedding a secure cryptoprocessor with dedicated hardware accelerators that improve the global platform security.

Multiples services are available using TPM (mostly in PC and mobile devices):

• Cryptographic keys generation, protection, management and utilization
• Cryptographic device identity
• Secure logging, log-reporting and attestation
• Secure non volatile storage
• Other functions including hashing, random number generator and secure clock

Several use cases are available:

• Platform integrity: the boot process relies on TPM for software integrity and authentication during each boot stage
• Disk encryption: encrypt and decrypt drive using TPM crypto core
• Password protection, ...

The STM33TPM12 is provided with different interfaces:

• I2C : ST33TPM12I2C
• SPI : ST33TPM12SPI
• LPC : ST33TPM12SPI

3.2 Support in Linux Kernel

TPM is ready to be used with OpenSTLinux distribution.
The TPM drivers (I2C and SPI) are part of the following kernel driver bindings:
Documentation/devicetree/bindings/security/tpm/st33zp24-i2c.txt
Documentation/devicetree/bindings/security/tpm/st33zp24-spi.txt
Source code:
drivers/char/tpm/st33zp24/i2c.c
drivers/char/tpm/st33zp24/spi.c
TPM support relies on a TCG open source TPM2 Software Stack (TSS).

3.3 Support in U-BOOT

TPM is supported with existing uclass of the 'Driver Model'.

• tpm
  • uclass: drivers/tpm/tpm-uclass.c .
  • driver: drivers/tpm/tpm_tis_st33zp24_i2c.c
  • driver: drivers/tpm/tpm_tis_st33zp24_spi.c