1tpm2_nvreadpublic(1)        General Commands Manual       tpm2_nvreadpublic(1)
2
3
4

NAME

6       tpm2_nvreadpublic(1) - Display all defined Non-Volatile (NV)s indices.
7

SYNOPSIS

9       tpm2_nvreadpublic [OPTIONS]
10

DESCRIPTION

12       tpm2_nvreadpublic(1)  -  Display all defined Non-Volatile (NV)s indices
13       to stdout in a YAML format.
14
15       Display metadata for all defined NV indices.  Metadata includes:
16
17       • The size of the defined region.
18
19       • The hash algorithm used to compute the name of the index.
20
21       • The auth policy.
22
23       • The NV attributes as defined in section "NV Attributes".
24
25   Example Output
26       ``` 0x1500015: hash algorithm: friendly: sha256 value: 0xB  attributes:
27       friendly:  ownerwrite|ownerread value: 0x2000200 size: 32 authorization
28       policy:
29
30       0x1500017: hash algorithm:  friendly:  sha256  value:  0xB  attributes:
31       friendly:  ownerwrite|ownerread value: 0x2000200 size: 32 authorization
32       policy: ```
33

OPTIONS

35       This tool takes no tool specific options.
36

COMMON OPTIONS

38       This collection of options are common to many programs and provide  in‐
39       formation that many users may expect.
40
41-h,  --help=[man|no-man]:  Display the tools manpage.  By default, it
42         attempts to invoke the manpager for the  tool,  however,  on  failure
43         will  output  a short tool summary.  This is the same behavior if the
44         "man" option argument is specified, however if explicit "man" is  re‐
45         quested,  the  tool  will  provide errors from man on stderr.  If the
46         "no-man" option if specified, or the manpager fails,  the  short  op‐
47         tions will be output to stdout.
48
49         To  successfully use the manpages feature requires the manpages to be
50         installed or on MANPATH, See man(1) for more details.
51
52-v, --version: Display version information for this  tool,  supported
53         tctis and exit.
54
55-V,  --verbose:  Increase the information that the tool prints to the
56         console during its execution.  When using this option  the  file  and
57         line number are printed.
58
59-Q, --quiet: Silence normal tool output to stdout.
60
61-Z, --enable-errata: Enable the application of errata fixups.  Useful
62         if an errata fixup needs to be applied to commands sent to  the  TPM.
63         Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
64

TCTI Configuration

66       The  TCTI  or  "Transmission  Interface" is the communication mechanism
67       with the TPM.  TCTIs can be changed for communication with TPMs  across
68       different mediums.
69
70       To control the TCTI, the tools respect:
71
72       1. The command line option -T or --tcti
73
74       2. The environment variable: TPM2TOOLS_TCTI.
75
76       Note:  The  command  line option always overrides the environment vari‐
77       able.
78
79       The current known TCTIs are:
80
81       • tabrmd     -     The     resource     manager,     called      tabrmd
82         (https://github.com/tpm2-software/tpm2-abrmd).   Note that tabrmd and
83         abrmd as a tcti name are synonymous.
84
85       • mssim - Typically used for communicating to the TPM software  simula‐
86         tor.
87
88       • device - Used when talking directly to a TPM device file.
89
90       • none  - Do not initalize a connection with the TPM.  Some tools allow
91         for off-tpm options and thus support not using a TCTI.  Tools that do
92         not  support  it  will error when attempted to be used without a TCTI
93         connection.  Does not support ANY options and MUST  BE  presented  as
94         the exact text of "none".
95
96       The  arguments  to  either  the  command line option or the environment
97       variable are in the form:
98
99       <tcti-name>:<tcti-option-config>
100
101       Specifying an empty string for  either  the  <tcti-name>  or  <tcti-op‐
102       tion-config> results in the default being used for that portion respec‐
103       tively.
104
105   TCTI Defaults
106       When a TCTI is not specified, the default TCTI is  searched  for  using
107       dlopen(3)  semantics.   The  tools  will  search for tabrmd, device and
108       mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND.  You  can  query
109       what TCTI will be chosen as the default by using the -v option to print
110       the version information.  The "default-tcti" key-value pair will  indi‐
111       cate which of the aforementioned TCTIs is the default.
112
113   Custom TCTIs
114       Any TCTI that implements the dynamic TCTI interface can be loaded.  The
115       tools internally use dlopen(3), and the raw tcti-name value is used for
116       the lookup.  Thus, this could be a path to the shared library, or a li‐
117       brary name as understood by dlopen(3) semantics.
118

TCTI OPTIONS

120       This collection of options are used to configure the various known TCTI
121       modules available:
122
123device: For the device TCTI, the TPM character device file for use by
124         the device TCTI can be specified.  The default is /dev/tpm0.
125
126         Example:   -T   device:/dev/tpm0   or   export    TPM2TOOLS_TCTI="de‐
127         vice:/dev/tpm0"
128
129        mssim:  For  the  mssim  TCTI, the domain name or IP address and port
130         number used by the simulator  can  be  specified.   The  default  are
131         127.0.0.1 and 2321.
132
133         Example:  -T  mssim:host=localhost,port=2321  or export TPM2TOOLS_TC‐
134         TI="mssim:host=localhost,port=2321"
135
136        abrmd: For the abrmd TCTI, the configuration string format is  a  se‐
137         ries  of  simple  key value pairs separated by a ',' character.  Each
138         key and value string are separated by a '=' character.
139
140         • TCTI abrmd supports two keys:
141
142           1. 'bus_name' : The name of  the  tabrmd  service  on  the  bus  (a
143              string).
144
145           2. 'bus_type' : The type of the dbus instance (a string) limited to
146              'session' and 'system'.
147
148         Specify the tabrmd tcti name and a config string of  bus_name=com.ex‐
149         ample.FooBar:
150
151         \--tcti=tabrmd:bus_name=com.example.FooBar
152
153         Specify the default (abrmd) tcti and a config string of bus_type=ses‐
154         sion:
155
156         \--tcti:bus_type=session
157
158         NOTE: abrmd and tabrmd are synonymous.
159

NV Attributes

161       NV Attributes are used to control various properties of the NV  defined
162       space.   When  specified  as an option, either the raw bitfield mask or
163       "nice-names" may be used.  The values can be found in Table 204 Part  2
164       of the TPM2.0 specification, which can be found here:
165
166       <https://trustedcomputinggroup.org/wp-content/uploads/TPM-
167       Rev-2.0-Part-2-Structures-01.38.pdf>
168
169       Nice names are calculated by taking the name field of table 204 and re‐
170       moving  the  prefix  TPMA_NV_  and  lowercasing  the result.  Thus, TP‐
171       MA_NV_PPWRITE becomes ppwrite.  Nice names can be joined using the bit‐
172       wise or "|" symbol.
173
174       Note  that the TPM_NT field is 4 bits wide, and thus can be set via nt=
175       format.   For  instance,  to  set  The  fields  TPMA_NV_OWNERREAD,  TP‐
176       MA_NV_OWNERWRITE,  TPMA_NV_POLICYWRITE, and TPMA_NT = 0x2, the argument
177       would be:
178
179       ownerread|ownerwrite|policywrite|nt=0x2
180
181       Additionally, the NT field, which denotes the type of the NV index, can
182       also  be  specified  via friendly names: * ordinary - Ordinary contains
183       data that is opaque  to  the  TPM  that  can  only  be  modified  using
184       TPM2_NV_Write.   *  extend  - Extend is used similarly to a PCR and can
185       only be modified with TPM2_NV_Extend.  Its size is  determined  by  the
186       length  of  the  hash  algorithm used.  * counter - Counter contains an
187       8-octet value that is to be used as a counter and can only be  modified
188       with  TPM2_NV_Increment * bits - Bit Field contains an 8-octet value to
189       be used as a bit field and can only be modified  with  TPM2_NV_SetBits.
190       *  pinfail - PIN Fail contains an 8-octet pinCount that increments on a
191       PIN authorization failure and a pinLimit.  * pinpass -  PIN  Pass  con‐
192       tains  an  8-octet pinCount that increments on a PIN authorization suc‐
193       cess and a pinLimit.
194
195       For instance, to set The fields TPMA_NV_OWNERREAD,  TPMA_NV_OWNERWRITE,
196       TPMA_NV_POLICYWRITE, and TPMA_NT = bits, the argument would be:
197
198       ownerread|ownerwrite|policywrite|nt=bits
199

EXAMPLES

201   List the defined NV indices to stdout
202              tpm2_nvreadpublic
203

Returns

205       Tools can return any of the following codes:
206
207       • 0 - Success.
208
209       • 1 - General non-specific error.
210
211       • 2 - Options handling error.
212
213       • 3 - Authentication error.
214
215       • 4 - TCTI related error.
216
217       • 5 - Non supported scheme.  Applicable to tpm2_testparams.
218

BUGS

220       Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
221

HELP

223       See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
224
225
226
227tpm2-tools                                                tpm2_nvreadpublic(1)
Impressum