wolfTPM succcessfully built but examples don't work?

[OevreFlataeker]

I am a new user of wolfTPM.
I previously built wolfSSL and installed it into prefix /usr/local on my Raspi4 with Debian Bookworm

git clone https://github.com/wolfSSL/wolfssl.git
cd wolfssl
./autogen.sh
./configure --enable-wolftpm
make
sudo make install
sudo ldconfig

I then configured wolfTPM and built it:

./configure --with-wolfcrypt=/usr/local/ --enable-infineon
[...]

Configuration summary for wolftpm version 3.10.0

   * Installation prefix:       /usr/local
   * System type:               unknown-linux-gnu
   * Host CPU:                  aarch64
   * C Compiler:                gcc
   * C Flags:                    -Werror -Wno-pragmas -Wall -Wno-strict-aliasing -Wextra -Wunknown-pragmas --param=ssp-buffer-size=1 -Waddress -Warray-bounds -Wbad-function-cast -Wchar-subscripts -Wcomment -Wfloat-equal -Wformat-security -Wformat=2 -Wmaybe-uninitialized -Wmissing-field-initializers -Wmissing-noreturn -Wmissing-prototypes -Wnested-externs -Wnormalized=id -Woverride-init -Wpointer-arith -Wpointer-sign -Wredundant-decls -Wshadow -Wsign-compare -Wstrict-overflow=1 -Wstrict-prototypes -Wswitch-enum -Wundef -Wunused -Wunused-result -Wunused-variable -Wwrite-strings -fwrapv
   * CPP Flags:                  -fvisibility=hidden -I/usr/local//include
   * Linker Flags:               -L/usr/local//lib
   * LIB Flags:                  -pie -z relro -z now -Werror
   * Wrappers:                  yes
   * Examples:                  yes
   * wolfCrypt:                 yes
   * Advanced IO:               no
   * I2C:                       no
   * Linux kernel TPM device:   no
   * SWTPM:                     no
   * WINAPI:                    no
   * TIS/SPI Check Wait State:  no
   * Infineon SLB967X           yes
   * STM ST33:                  no
   * Microchip ATTPM20:         no
   * Nuvoton NPCT75x:           no
   * Runtime Module Detection:  test
   * Firmware Upgrade Support:  yes

The built itself was also successful but none of the examples seem to work?

daubsi@pi4:~/infineon/wolfTPM/examples $ ./keygen/create_primary -rsa -oh
TPM2.0 Primary Key generation example
	Algorithm: RSA
	Store Handle: 0x00000000
	Use Parameter Encryption: NULL

wolfTPM2_Init failed

Failure 0x101: TPM_RC_FAILURE

daubsi@pi4:~/infineon/wolfTPM/examples/wrap $ ./caps
TPM2 Get Capabilities
daubsi@pi4:~/infineon/wolfTPM/examples/wrap $ ./wrap_test
TPM2 Demo for Wrapper API's

What's wrong here?
The native tpm2-tools work as expected. I've stopped the tpm2-abrmd daemon as well before trying to run any examples.

[OevreFlataeker]

Building like this fixed the problem:

./configure --enable-debug --enable-firmware --enable-autodetect --enable-devtpm --enable-infineon=slb9670 && make
[...]
sudo systemctl stop tpm2-abrmd && sudo ./examples/wrap/caps
TPM2 Get Capabilities
TPM2: Caps 0x00000000, Did 0x0000, Vid 0x0000, Rid 0x 0
Mfg IFX (1), Vendor SLB9670, Fw 7.86 (0x4bc1), FIPS 140-2 1, CC-EAL4 0
Handles Cap: Start 0x81000000, Count 0
Found 0 persistent handles
Assigned PCR's:
	SHA1:
	SHA256:  0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
wolfTPM caps read successfully
wolfTPM2_Reset complete

[dgarske]

The --enable-devtpm is the one you needed. It uses /dev/tpm0.

[OevreFlataeker]

Thanks figured that out now :-) How is it interacting if that's omitted? Bit-banging the SPI interface directly?

[dgarske]

Thanks figured that out now :-) How is it interacting if that's omitted? Bit-banging the SPI interface directly?

The /dev/tpm0 actually uses the SPI interface under it and has its own TIS driver. If you want to enable and use the /dev/spidev directly you need to modify your /boot/config.txt to comment out the TPM overlay and uncomment the spidev.

# Uncomment some or all of these to enable the optional hardware interfaces
dtparam=i2c_arm=on
#dtparam=i2s=on
dtparam=spi=on

# TPM
#dtoverlay=tpm-slb9670

[OevreFlataeker]

So without specifying devtpm in the configure wolftpm would be competing with the kernel for the SPI device? (Yes, I have the overlay loaded)

[dgarske]

So without specifying devtpm in the configure wolftpm would be competing with the kernel for the SPI device? (Yes, I have the overlay loaded)

Yes the default ./configure will try and use our built-in TIS layer and try /dev/spidev0.0 and /dev/spidev0.1, etc. It also enables the "auto detect" feature so it will scan for TPM's on the spidev.

[OevreFlataeker]

Got it! I was assuming it might try SPI, but it was not evident, least because there was not a single error or warning, that the SPI device could not be claimed, found or anything.

daubsi@pi4:~/infineon/wolfTPM/examples/wrap $ ./caps
TPM2 Get Capabilities
daubsi@pi4:~/infineon/wolfTPM/examples/wrap $ ./wrap_test
TPM2 Demo for Wrapper API's

Would be a good thing to log, maybe?

[dgarske]

Got it! I was assuming it might try SPI, but it was not evident, least because there was not a single error or warning, that the SPI device could not be claimed, found or anything.

daubsi@pi4:~/infineon/wolfTPM/examples/wrap $ ./caps
TPM2 Get Capabilities
daubsi@pi4:~/infineon/wolfTPM/examples/wrap $ ./wrap_test
TPM2 Demo for Wrapper API's

Would be a good thing to log, maybe?

Good ideas. @aidangarske will you work on this please?

[aidangarske]

Yes I will add better logging on this issue!

[OevreFlataeker]

Thanks! ❤️