How can I determine if I have TPM support with currently supported versions of Ubuntu?

Question

I want to know how to enable TPM. I found the TPM settings in the BIOS, but I am not able to click. How can I determine if I have TPM support with currently supported versions of Ubuntu?

Answer 1

Most systems today support TPM but it's typically not enabled by default as many of us never use it. All that aside, the first thing you need to do is to enable TPM in your UEFI/BIOS. How to access and enable that varies depending on Manufacturer, so check your system manual or motherboard manual to locate directions for the process. Once you've toggled support on you can check with

ls -la /lib/modules/`uname -r`/kernel/drivers/char/tpm

Here's my output:

drwxr-xr-x 3 root root  4096 Jun 24 06:11 .
drwxr-xr-x 9 root root  4096 Jun 24 06:11 ..
drwxr-xr-x 2 root root  4096 Jun 24 06:11 st33zp24
-rw-r--r-- 1 root root 12513 Jun 18 11:49 tpm_atmel.ko
-rw-r--r-- 1 root root 12481 Jun 18 11:49 tpm_i2c_atmel.ko
-rw-r--r-- 1 root root 16657 Jun 18 11:49 tpm_i2c_infineon.ko
-rw-r--r-- 1 root root 23025 Jun 18 11:49 tpm_i2c_nuvoton.ko
-rw-r--r-- 1 root root 22937 Jun 18 11:49 tpm_infineon.ko
-rw-r--r-- 1 root root 17753 Jun 18 11:49 tpm_nsc.ko
-rw-r--r-- 1 root root 12761 Jun 18 11:49 tpm_tis_spi.ko
-rw-r--r-- 1 root root 19449 Jun 18 11:49 tpm_vtpm_proxy.ko
-rw-r--r-- 1 root root 15289 Jun 18 11:49 xen-tpmfront.ko

Then you can check for support with

tpm_version

If you get

Command 'tpm_version' not found, but can be installed with:
sudo apt install tpm-tools

Install as instructed and try again.

If you get:

tpm_version Tspi_Context_Connect failed: 0x00003011 - layer=tsp, code=0011 (17), Communication failure

Odds are good you don't have TPM support, don't have a TPM chip or you've failed to properly toggle TPM support on in your UEFI/BIOS.

TPMs don't necessarily appear in the ACPI tables, but the modules do print a message when they find a supported module; for example

[  134.026892] tpm_tis 00:08: 1.2 TPM (device-id 0xB, rev-id 16)

So dmesg | grep -i tpm is a good way to check.

Sources:

• https://mhsamsal.wordpress.com/2014/12/11/how-to-enable-tpm-in-linux-communicate-with-it-and-check-the-pcr-values/

• https://unix.stackexchange.com/questions/341629/how-to-determine-if-computer-has-tpm-trusted-platform-module-available