tpm2-abrmd vs /dev/tpmrm0

[shekharpaty]

Hello all,
what is the difference between tpm2-abrmd vs /dev/tpmrm0, can we use existing tpmrm instead of abrmd, if yes please provide any reference document to configure the tpmrm with tpm2-tss, tpm2tools.

Goal is to achieve create key, encrypt and decrypt 128 bytes data using FAPI APIs.

I have complied tpm2-tss and tpm2-tools on our Linux Rhel system, tpm2-abrmd have some extra dependences to compile so planning to use tpmrm.

[williamcroberts]

You won't see any issues with FAPI or the tss2 prefixes tools IIUC. However, if you use the tpm2_policy tools you'll have issues with the session being flushed from the tpm between commands.

[shekharpaty]

@williamcroberts thankyou, it means we can use tpmrm and what is tom2_policy ? please can you provide more info.

is that a typo? tpm2_policy and I will be using tss2_provision and tpm2_clear.

apart from "tcti"="device:/dev/tpm0" , anywhere else we have to pass /dev/tpmrm0 , any supporting documents we have to set the tpmrm with tpm-tss.

[williamcroberts]

@williamcroberts thankyou, it means we can use tpmrm and what is tom2_policy ? please can you provide more info.

Apparently my phone likes to autocorrect tpm to tom.
I edited that comment to make it correct.

is that a typo? tpm2_policy and I will be using tss2_provision and tpm2_clear.

Yes and no worries with those tools.

apart from "tcti"="device:/dev/tpm0" , anywhere else we have to pass /dev/tpmrm0 , any supporting documents we have to set the tpmrm with tpm-tss.

IIUC tss2_ tools just use the FAPI config, tpm2_ tools use the --tcti option, but you usually don't have to specify it. The search pattern will discover it automatically.

[shekharpaty]

After copying tm2-tools and tpm2-tss libs to the device i tried this.

 ./tss2_provision
WARNING:esys:src/tss2-esys/api/Esys_CreatePrimary.c:393:Esys_CreatePrimary_Finish() Received TPM Error
Authorize /HE "Endorsement Hierarchy":
WARNING:esys:src/tss2-esys/api/Esys_CreatePrimary.c:393:Esys_CreatePrimary_Finish() Received TPM Error
ERROR:fapi:src/tss2-fapi/fapi_util.c:761:ifapi_init_primary_finish() ErrorCode (0x000009a2) FAPI Provision
ERROR:fapi:src/tss2-fapi/api/Fapi_Provision.c:578:Fapi_Provision_Finish() Init primary finish ErrorCode (0x000009a2)
ERROR:fapi:src/tss2-fapi/api/Fapi_Provision.c:168:Fapi_Provision() ErrorCode (0x000009a2) Provision
Fapi_Provision(0x9A2) - tpm:session(1):authorization failure without DA implications

why tss2_provison asking for Authorize /HE "Endorsement Hierarchy" ? I am running as root.
Meanwhile I ran this to test some commaonds.

./tpm2_getcap --tcti device:/dev/tpmrm0 properties-fixed
TPM2_PT_FAMILY_INDICATOR:
raw: 0x322E3000
value: "2.0"

[williamcroberts]

The TPM is its own separate device it doesn't care what your permissions are from the operating system. To create the EK which is part of tss2_provision, you need endorsement hierarchy authorization so I'm not sure how you do that in fapi/tss2 prefixes tools its probably some command line parameter.

[shekharpaty]

@williamcroberts will be closing the issue I have setup the qemu and swtpm and validated the tpmrm can be used , without abrmd.