ERROR:tcti:src/tss2-tcti/tcti-device.c:319:Tss2_Tcti_Device_Init() Failed to open device file /dev/tpm0: Device or resource busy

[glassman81]

Hello. As the above subject indicates, I've not had the easiest time trying to get the access broker service to run correctly. I'm using the master branch for tpm2-tss, tpm2-abrmd, and tpm2-tools, current as of this writing.

I have an Infineon hardware TPM (SLM9670) running on a raspberry pi 3b. So far, I have been able to compile everything and the only thing I've tweaked is the udev rules due to permissions issues which seem to be ok now, as indicated below.

pi@raspberrypi:~$ ls -al /dev/tpm* crw-rw-rw-. 1 tss root 10, 224 Aug 26 01:38 /dev/tpm0 crw-rw-rw-. 1 tss tss 236, 65536 Aug 26 01:38 /dev/tpmrm0

However, when I get the debug messages for tpm2-abrmd, I see a series of failures, and I'm not quite sure how to fix them.

pi@raspberrypi:~$ sudo -u tss G_MESSAGES_DEBUG=all tpm2-abrmd
** INFO: 04:33:45.695: tabrmd startup

** (process:17479): WARNING **: 04:33:45.696: tcti_conf before: "device:/dev/tpm0"
** INFO: 04:33:45.696: logging to stdout

** (tpm2-abrmd:17479): WARNING **: 04:33:45.696: tcti_conf after: "device:/dev/tpm0"
** INFO: 04:33:45.696: entering g_main_loop
** INFO: 04:33:45.697: init_thread_func start
** (tpm2-abrmd:17479): DEBUG: 04:33:45.698: random_class_init
** (tpm2-abrmd:17479): DEBUG: 04:33:45.698: opening entropy source: /dev/urandom
** (tpm2-abrmd:17479): DEBUG: 04:33:45.698: reading from entropy source: /dev/urandom
** (tpm2-abrmd:17479): DEBUG: 04:33:45.698: connection_manager_set_property
** (tpm2-abrmd:17479): DEBUG: 04:33:45.698: max_connections: 27
** (tpm2-abrmd:17479): DEBUG: 04:33:45.699: IpcFrontendDbus set bus_name: com.intel.tss2.Tabrmd
** (tpm2-abrmd:17479): DEBUG: 04:33:45.699: ipc_frontend_connect
** (tpm2-abrmd:17479): DEBUG: 04:33:45.702: tcti_factory_create: TctiFactory with TCTI conf 'device:/dev/tpm0'
ERROR:tcti:src/tss2-tcti/tcti-device.c:319:Tss2_Tcti_Device_Init() Failed to open device file /dev/tpm0: Device or resource busy
WARNING:tcti:src/tss2-tcti/tctildr.c:62:tcti_from_init() TCTI init for function 0xb5fbf680 failed with a000a
WARNING:tcti:src/tss2-tcti/tctildr.c:92:tcti_from_info() Could not initialize TCTI named: tcti-device
ERROR:tcti:src/tss2-tcti/tctildr-dl.c:150:tcti_from_file() Could not initialize TCTI file: device
ERROR:tcti:src/tss2-tcti/tctildr.c:418:Tss2_TctiLdr_Initialize_Ex() Failed to instantiate TCTI
** INFO: 04:33:45.705: tcti_factory_create: failed to initialize TCTI, RC: 0xa000a

** (tpm2-abrmd:17479): CRITICAL **: 04:33:45.705: init_thread_func: failed to create TCTI with conf "device:/dev/tpm0"
** (tpm2-abrmd:17479): DEBUG: 04:33:45.706: init_thread_func: calling gmain_data_cleanup
** (tpm2-abrmd:17479): DEBUG: 04:33:45.706: gmain_data_cleanup
** (tpm2-abrmd:17479): DEBUG: 04:33:45.706: ipc_frontend_disconnect

(tpm2-abrmd:17479): GLib-GIO-CRITICAL **: 04:33:45.706: g_bus_unown_name: assertion 'owner_id > 0' failed
** (tpm2-abrmd:17479): DEBUG: 04:33:45.706: random_finalize
** INFO: 04:33:45.706: main_loop_quit
** INFO: 04:33:45.706: g_main_loop_run done, cleaning up
** (tpm2-abrmd:17479): DEBUG: 04:33:45.707: gmain_data_cleanup
** INFO: 04:33:45.707: main_loop_quit

Any help here would be greatly appreciated. I'm. a student, and this is just the first part of what I'm trying to accomplish for a project. However, due to my limited knowledge in this area, I've been stuck here for days.

[AndreasFuchsTPM]

"Device or resource busy" usually means that some other process has it open.
try lsof | grep tpm to catch the sneaky program.

[glassman81]

@AndreasFuchsSIT Thank you for the help.

I had to install that package, and after running that command piped to grep, I get this output. I used tpm0 instead of tpm with grep as that was too noisy. Let me know if I need to include that too.

pi@raspberrypi:~$ sudo lsof | grep tpm0
tpm2-abrm 15200 tss 7u CHR 10,224 0t0 11220 /dev/tpm0
tpm2-abrm 15200 15202 gmain tss 7u CHR 10,224 0t0 11220 /dev/tpm0
tpm2-abrm 15200 15204 gdbus tss 7u CHR 10,224 0t0 11220 /dev/tpm0
tpm2-abrm 15200 15205 tpm2-abrm tss 7u CHR 10,224 0t0 11220 /dev/tpm0
tpm2-abrm 15200 15206 tpm2-abrm tss 7u CHR 10,224 0t0 11220 /dev/tpm0
tpm2-abrm 15200 15207 tpm2-abrm tss 7u CHR 10,224 0t0 11220 /dev/tpm0

I don't see any other process except for "tpm2-abrm" attempting to access dev/tpm0. Is there something I'm missing?

[glassman81]

I temporarily backed out of the master branch tss stack, tools, and resource broker to install tpm2-tools and tpm2-abrmd from an aptitude install (includes libtss2-esys0 and libtss2-udev), and I get the same results. The resource is busy. I'm not sure how to proceed, and I've done everything according to the website instructions. For instance, here's how I built the tools and stack:

sudo apt-get -y install autoconf-archive libcmocka0 libcmocka-dev procps iproute2 build-essential git pkg-config gcc libtool automake libssl-dev uthash-dev autoconf doxygen libltdl-dev libglib2.0-dev libcurl4-openssl-dev python-yaml

sudo useradd --system --user-group tss

git clone https://github.com/tpm2-software/tpm2-tss.git
cd tpm2-tss
./bootstrap && ./configure --with-udevrulesdir=/etc/udev/rules.d --libdir=/usr/lib/arm-linux-gnueabihf --prefix=/usr
make
sudo make install

git clone https://github.com/tpm2-software/tpm2-abrmd.git
cd tpm2-abrmd
./bootstrap && ./configure --with-dbuspolicydir=/etc/dbus-1/system.d --with-systemdsystemunitdir=/lib/systemd/system --libdir=/usr/lib/arm-linux-gnueabihf --prefix=/usr
make
sudo make install

sudo systemctl enable /usr/lib/arm-linux-gnueabihf/systemd/system/tpm2-abrmd.service

sudo udevadm control --reload-rules && sudo udevadm trigger
sudo pkill -HUP dbus-daemon
sudo systemctl daemon-reload
sudo ldconfig

git clone https://github.com/tpm2-software/tpm2-tools.git
cd tpm2-tools
./bootstrap && ./configure --prefix=/usr
make
sudo make install

It's frustrating as there's no discernible reason as to why the resource is busy. Does anyone have any ideas?

[tstruk]

Could try to run some tool directly on TPM without the abrmd first:
$ sudo systemctl stop tpm2-abrmd
$ sudo tpm2_getrandom -T device:/dev/tpm0 32

[glassman81]

@tstruk Hello. When I do that, I get an output similar to the following:

????f?66G0i-0;fa?l?>?栐??*

I assume this is desired, although I'm not sure why the access broker can't initialize the TCTI.

[diabonas]

I would suspect tpm2-abrmd is already running because it was started automatically by the D-Bus service and you are trying to start a second daemon with sudo -u tss G_MESSAGES_DEBUG=all tpm2-abrmd, which fails: usually you shouldn't try to do that manually, just install tpm2-abrmd and try running e.g. any tpm2-tools command, that should start the service automatically. This theory is supported by your lsof output, because apparently there is a tpm2-abrmd process running (it can't be the one you tried to start unsuccessfully, because that has already terminated).

@tstruk Hello. When I do that, I get an output similar to the following:

????f?66G0i-0;fa?l?>?栐??*

These are the random bytes returned by the TPM, so the call was successful. Now try tpm2_getrandom -T tabrmd 32 without trying to start tpm2-abrmd manually first and see whether that works.

[glassman81]

@diabonas Thank you, and you’re absolutely correct. I guess I should have known more about how that works as I didn’t realize another instance was being started, but it did work when I just tried getrandom with the access broker specified. I was having other issues initially, so I was all over the map, taking this one shot in the dark when I posted here.

The only other issue I have now is that I’m getting a DA lockout error when I try to to issue a tpm2_clear. I didn’t realize that the device gets locked out so easily, with nothing you can do except wait a certain amount of time.