Re: [tpm2] TCTI initialization fails with error 0xc000b

[Javier Martinez Canillas <javierm at redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 2871 bytes --]

Hello Dan,

On 02/22/2018 05:01 PM, Anderson, Daniel wrote:
> Javier,
> Thanks!
> 
> The version is the latest source as of the message--I pulled the latest source and rebuilt several times.

Ok, I'm also building today's master branch for all projects.

> I will try again today and see if there has been a fix in the past week.
> There is no /dev/tpm--I am using the simulator and specify that in the options.

I didn't see the option specified in the command you shared in this thread.
You have to run with tpm2-abrmd --tcti socket.

> There may be another option or setting that I am missing though.
> Here is what I build with:
> 
> For tpm2-tss:
> configure --enable-unit
>         --with-simulatorbin=$TPM_SERVER

Only these are valid options for tpm2-tss, from here are tpm2-abrmd options:

>         --with-dbuspolicydir=/etc/dbus-1/system.d
>         --with-systemdsystemunitdir=/lib/systemd/system
>         --with-systemdpresetdir=/lib/systemd/system-preset
>         --with-udevrulesdir=/etc/udev/rules.d
>         --with-sysdefaultdir=/etc/default
>         --with-dbusdatadir=/usr/share/dbus-1/system-services
>
> For tpm2-abrmd:
> configure --enable-unit --with-simulatorbin=$HOME/tpm/simulator/src/tpm_server
>

As mentioned, you either got the configure options mixed up or are using it wrong.

There are my configure options for tpm2-tss, tpm2-abrmd and tpm2-tools:

tpm2-tss:

$ ./configure --prefix=/usr

tpm2-abrmd:

$ ./configure --with-dbuspolicydir=/etc/dbus-1/system.d --with-udevrulesdir=/usr/lib/udev/rules.d --with-systemdsystemunitdir=/usr/lib/systemd/system --libdir=/usr/lib64

tpm2-tools

$ ./configure --prefix=/usr

> I cannot believe that anyone has tpm2-abrmd working without special hand-copied fixes. The com.intel.tss2.tabrmd.service for example is not installed in /usr/share/dbus-1/system-services/ but in /usr/local/share/dbus-1/system-services/.
>

I think this is because you didn't specify a correct --with-dbuspolicydir
as mentioned before. Another thing that you have to keep in mind, is that
the default D-Bus config only allows the tss and root user to acquire the
com.intel.tss2.Tabrmd D-Bus well-known name.

So after installing latest master with these configure options, I just do:

$ ./tpm_server

$ sudo -u tss /usr/local/sbin/tpm2-abrmd --tcti socket

$ tpm2_pcrlist -L sha1:0 -T abrmd                           
sha1:                      
  0 : 0x0000000000000000000000000000000000000003

And using the device TCTI also works for me:

$ sudo -u tss /usr/local/sbin/tpm2-abrmd --tcti device

$ tpm2_pcrlist -L sha1:0 -T abrmd                           
sha1:                      
  0 : 0xC72EC9E6CBC2B6A95F334DDDD6513981DA00F0C2

Best regards,
-- 
Javier Martinez Canillas
Software Engineer - Desktop Hardware Enablement
Red Hat