Howto Enable TPM Support on a Raspberry PI (0, 0W, 1, 2, 3, 3b+) and make it work with the LetsTrust TPM
UPDATE: Works for Pi 3b+, too!
Due to the recent inclusion of the TPM_TIS_SPI patches to the mainline kernel
and the consequent backports to v4.9.x and 4.11.x it's now much easier to get
the support for the LetsTrust TPM up and running.
No more patching necessary!
tldr: Enable CONFIG_TCG_TIS_SPI in your Kernel Config, and modify your
device tree accordingly.
This tutorial will show you how to perform these steps for your Raspberry PI
(0, 0W, 1, 2, 3).
It is assumed that you are cross-compiling from your desktop PC (i.e. not
building the kernel on the raspberry itself) and create everything in your home directory (
For more details please also read the excellent guide from the Raspberry Pi
Foundation on howto compile your kernel.
https://www.raspberrypi.org/documentation/linux/kernel/building.md
https://www.raspberrypi.org/documentation/linux/kernel/configuring.md
On a Ubuntu system you should install the following packages
First download the toolchain you need for cross compilation
and add the tools to your executable search path
Then grab the kernel sources
and enter the directory
Next step is to get the default kernel configuration:
For Pi 1, Pi 0, Pi 0 W, or Compute Module:
For Pi 2, Pi 3, or Compute Module 3:
Then we have to enable the TPM Support in the Kernel via make menuconfig
In this gui navigate to
and press M (for Module) or Y (for build-in support)
Then press enter to get into the subdirectory and select
also again either via M or Y
If you want to use the TPM's HardwareNumberGenerator feature, please select
Save and exit the menuconfig.
If this is too much hassle for you, you can also edit your .config file and
add these 5 lines to it.
Next step is to add our DeviceTree Overlay to our kernel sources.
Simply download letstrust-tpm-overlay.dts and copy it to arch/arm/boot/dts/overlays/letstrust-tpm-overlay.dts
Now build your kernel and device tree blob
please note the additional overlays/letstrust-tpm.dtbo
Now deploy your kernel and modules (standard rpi way, see howto above)
Before you unmount your RPI SD Card, open mnt/fat32/config.txt
and ensure the line dtparam=spi=on isn't commented out (so no # at the beginning of the line)
and add
just beneath it.
More Details:
https://www.raspberrypi.org/documentation/configuration/device-tree.md
https://www.raspberrypi.org/documentation/hardware/raspberrypi/spi/README.md
Of course we uploaded a reference config.txt for you
Unmount your SD card,
Put it into your PI and boot your raspberry pi.
After booting, on a shell do
(We are looking into it why it does not autoload)
You can tryout the functionality of your TPM with
https://github.com/Infineon/eltt2
Happy Hacking
p.s.: If you just want to try it out without compiling:
Download boot-v4.9.33.tpm.tar.bz2 (kernel, dtb, overlays) + modules-v4.9.33.tpm.tar.bz2
Extract the boot-v4.9.33.tpm.tar.bz2 into the boot partition of your rpi (e.g. sdb1) and the modules-v4.9.33.tpm.tar.bz2 into the second partition.(e.g. sdb2)
Due to the recent inclusion of the TPM_TIS_SPI patches to the mainline kernel
and the consequent backports to v4.9.x and 4.11.x it's now much easier to get
the support for the LetsTrust TPM up and running.
No more patching necessary!
tldr: Enable CONFIG_TCG_TIS_SPI in your Kernel Config, and modify your
device tree accordingly.
This tutorial will show you how to perform these steps for your Raspberry PI
(0, 0W, 1, 2, 3).
It is assumed that you are cross-compiling from your desktop PC (i.e. not
building the kernel on the raspberry itself) and create everything in your home directory (
~).For more details please also read the excellent guide from the Raspberry Pi
Foundation on howto compile your kernel.
https://www.raspberrypi.org/documentation/linux/kernel/building.md
https://www.raspberrypi.org/documentation/linux/kernel/configuring.md
On a Ubuntu system you should install the following packages
gcc-arm-linux-gnueabihf
gddrescue
git
libncurses5-dev
bcFirst download the toolchain you need for cross compilation
$ git clone https://github.com/raspberrypi/toolsand add the tools to your executable search path
$ export PATH=$PATH:~/toolsThen grab the kernel sources
$ git clone --depth=1 https://github.com/raspberrypi/linuxand enter the directory
$ cd linuxNext step is to get the default kernel configuration:
For Pi 1, Pi 0, Pi 0 W, or Compute Module:
$ KERNEL=kernel
$ make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- bcmrpi_defconfigFor Pi 2, Pi 3, or Compute Module 3:
$ KERNEL=kernel7
$ make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- bcm2709_defconfig
Then we have to enable the TPM Support in the Kernel via make menuconfig
$ make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- menuconfigIn this gui navigate to
Device Drivers
---> Character devices
---> TPM Hardware Supportand press M (for Module) or Y (for build-in support)
Then press enter to get into the subdirectory and select
---> TPM Interface Specification 1.3 Interface / TPM 2.0 FIFO Interface - (SPI)also again either via M or Y
If you want to use the TPM's HardwareNumberGenerator feature, please select
---> Hardware Random Number Generator Core support
---> TPM HW Random Number Generator supportSave and exit the menuconfig.
If this is too much hassle for you, you can also edit your .config file and
add these 5 lines to it.
CONFIG_HW_RANDOM_TPM=m
CONFIG_TCG_TPM=m
CONFIG_TCG_TIS_CORE=m
CONFIG_TCG_TIS_SPI=m
CONFIG_SECURITYFS=yNext step is to add our DeviceTree Overlay to our kernel sources.
Simply download letstrust-tpm-overlay.dts and copy it to arch/arm/boot/dts/overlays/letstrust-tpm-overlay.dts
$ wget http://letstrust.de/uploads/letstrust-tpm-overlay.dts -O arch/arm/boot/dts/overlays/letstrust-tpm-overlay.dtsNow build your kernel and device tree blob
$ make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- zImage modules dtbs overlays/letstrust-tpm.dtbo -j8please note the additional overlays/letstrust-tpm.dtbo
Now deploy your kernel and modules (standard rpi way, see howto above)
$ mkdir mnt/fat32
$ mkdir mnt/ext4
$ sudo mount /dev/sdb1 mnt/fat32
$ sudo mount /dev/sdb2 mnt/ext4
$ sudo make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- INSTALL_MOD_PATH=mnt/ext4 modules_install
$ sudo cp mnt/fat32/$KERNEL.img mnt/fat32/$KERNEL-backup.img
$ sudo cp arch/arm/boot/zImage mnt/fat32/$KERNEL.img
$ sudo cp arch/arm/boot/dts/*.dtb mnt/fat32/
$ sudo cp arch/arm/boot/dts/overlays/*.dtb* mnt/fat32/overlays/
$ sudo cp arch/arm/boot/dts/overlays/README mnt/fat32/overlays/Before you unmount your RPI SD Card, open mnt/fat32/config.txt
and ensure the line dtparam=spi=on isn't commented out (so no # at the beginning of the line)
and add
dtoverlay=letstrust-tpmjust beneath it.
More Details:
https://www.raspberrypi.org/documentation/configuration/device-tree.md
https://www.raspberrypi.org/documentation/hardware/raspberrypi/spi/README.md
Of course we uploaded a reference config.txt for you
Unmount your SD card,
$ sudo umount mnt/fat32
$ sudo umount mnt/ext4Put it into your PI and boot your raspberry pi.
After booting, on a shell do
sudo modprobe tpm_tis_spi and /dev/tpm0 should be visible.(We are looking into it why it does not autoload)
You can tryout the functionality of your TPM with
https://github.com/Infineon/eltt2
Happy Hacking
p.s.: If you just want to try it out without compiling:
Download boot-v4.9.33.tpm.tar.bz2 (kernel, dtb, overlays) + modules-v4.9.33.tpm.tar.bz2
Extract the boot-v4.9.33.tpm.tar.bz2 into the boot partition of your rpi (e.g. sdb1) and the modules-v4.9.33.tpm.tar.bz2 into the second partition.(e.g. sdb2)
$ wget http://www.letstrust.de/uploads/boot-v4.9.33.tpm.tar.bz2 -O /tmp/boot-v4.9.33.tpm.tar.bz2
$ wget http://www.letstrust.de/uploads/modules-v4.9.33.tpm.tar.bz2 -O /tmp/modules-v4.9.33.tpm.tar.bz2
$ sudo mount /dev/sdb1 mnt/fat32
$ sudo mount /dev/sdb2 mnt/ext4
$ cd mnt/fat32
$ sudo tar -xvf /tmp/boot-v4.9.33.tpm.tar.bz2
$ cd ../ext4
$ sudo tar -xvf /tmp/modules-v4.9.33.tpm.tar.bz2
$ cd ..
$ sudo umount /dev/sdb1
$ sudo umount /dev/sdb2