This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). This stack consists of the following layers from top to bottom:
Instructions to build and install tpm2-tss are available in the INSTALL file.
If you're looking to discuss the source code in this project or get some questions answered you should join the 01.org TPM2 mailing list: https://lists.01.org/postorius/lists/tpm2.lists.01.org/. We also have an IRC channel set up on FreeNode called #tpm2.0-tss. You can also try Gitter
In case you want to contribute to the project, please also have a look at the Contribution Guidelines.
The doxygen documentation can either be built by oneself (see the INSTALL file) or browsed directly on tpm2-tss.readthedocs.io.
This repository contains a test suite intended to exercise the TCTI, SAPI and ESAPI code. This test suite is not intended to test a TPM implementation, so this test suite should only be run against a TPM simulator. If this test suite is executed against a TPM other than the software simulator it may cause damage to the TPM (NV storage wear out, etc.). You have been warned.
The TPM library specification contains reference code sufficient to construct a software TPM 2.0 simulator. This code was provided by Microsoft and they provide a binary download for Windows here. IBM has repackaged this code with a few Makefiles so that the Microsoft code can be built and run on Linux systems. The Linux version of the Microsoft TPM 2.0 simulator can be obtained here. Once you've downloaded and successfully built and execute the simulator it will, by default, be accepting connections on the localhost, TCP ports 2321 and 2322.
Issues building or running the simulator should be reported to the IBM software TPM2 project.
NOTE: The Intel TCG TSS is currently tested against version 974 of the simulator. Compatibility with later versions has not yet been tested.
To test the various TCTI, SAPI and ESAPI api calls, unit and integration tests can be run by configuring the build to enable unit testing and running the “check” build target. It is recommended to use a simulator for testing, and the simulator will be automatically launched by the tests. Please review the dependency list in INSTALL for dependencies when building the test suite.
$ ./configure --enable-unit --enable-integration $ make -j$(nproc) check
This will generate a file called “test-suite.log” in the root of the build directory.
Please report failures in a Github ‘issue’ with a full log of the test run.
NOTE: The unit and integration tests can be enabled independently. The --enable-unit option controls unit tests, and --enable-integration controls the integration tests.
To run integration tests on a physical TPM device, including a TPM hardware or a software TPM implemented in platform firmware the configure script provides two options. The first option is called --with-ptpm and it is used to point to the TPM device interface exposed by the OS, for example:
$ ./configure --with-ptpm=/dev/tpm0
The second option, --with-ptpmtests, enables a “class” of test. There are three classes:
For example to enable both mandatory and optional test cases during configure one needs to set this flag as follows:
$ ./configure --with-ptpmtests="mandatory,optional"
Tht default value for the flag is “mandatory” Any combination of the three is valid. The two flags are only valid when the integration tests are enabled with --enable-integration flag.
After that the following command is used to run the test on the configured TPM device:
$ sudo make check-ptpm
$ sudo make check -j 1
Note: The tests can not be run in paralel.
The unit and integration tests can be run under the valgrind tool, which performs additional checks on the library and test code, such as memory leak checks etc. The following command is used to run the tests under valgrind:
$ make check-valgrind
This command will enable all valgrind “tools” and kick off as many test as many tools it supports. It is possible to enable different valgrind tools (checks) in more granularity. This can be controlled by invoking different tools separately using check-valgrind-<tool>, for instance:
$ make check-valgrind-memcheck
$ make check-valgrind-drd
Currently the the following tools are supported:
memcheck - Performs memory related checks. This is the default tool. helgrind - Performs synchronization errors checks. drd - Performs thread related checks. sgcheck - Performs stack overrun related checks.
Note that the valgring tool can also be invoked manually using the standard libtool:
$ libtool exec valgrind --tool=memcheck --leak-check=full \ test/integration/esys-auto-session-flags.int
This allows for more control on what checks are performed.
While investigating issues it might be helpful to enable extra debug/trace output. It can be enabled separately for different components. The description how to do this can be found in the logging file.
All system API function calls can be tested using a fuzzing library. The description how to do this can be found in the fuzzing file.
SAPI library, TAB/RM, and Test Code Block Diagram:
├── doc : various bits of documentation\ ├── include : header files installed in $(includedir)\ │ └── tss2 : all public headers for this project\ ├── lib : data files used by the build or installed into $(libdir)\ ├── m4 : autoconf support macros\ ├── man : man pages\ ├── script : scripts used by the build or CI\ ├── src : all source files\ │ ├── tss2-esys : enhanced system API (ESAPI) implementation\ │ │ └── api : ESAPI TPM API implementation\ │ ├── tss2-mu : TPM2 type marshaling/unmarshaling (MU) API implementation\ │ ├── tss2-sys : system API (SAPI) implementation\ │ │ └── api : SAPI public API implementation\ │ ├── tss2-tcti : TCTI implementations for device and mssim\ │ └── util : Internal utility library (e.g. logging framework)\ └── test : test code\ ├── integration : integration test harness and test cases\ ├── tpmclient : monolithic, legacy test application\ └── unit : unit tests