1tpm2_pcrextend(1)           General Commands Manual          tpm2_pcrextend(1)
2
3
4

NAME

6       tpm2_pcrextend(1) - Extends a PCR.
7

SYNOPSIS

9       tpm2_pcrextend [OPTIONS] PCR_DIGEST_SPEC
10

DESCRIPTION

12       tpm2_pcrextend(1)  -  Extends the pcrs with values indicated by PCR_DI‐
13       GEST_SPEC.
14
15       A PCR_DIGEST_SPEC is defined as follows:
16
17       • A numerical PCR identifier.
18
19       • A colon followed by the algorithm hash specification.
20
21       The algorithm hash specification is as follows: * The algorithm friend‐
22       ly name or raw numerical.  * An equals sign.  * The hex hash value.
23
24   Example Digest Specification
25              4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
26
27       Note:  Multiple  specifications  of PCR and hash are allowed.  Multiple
28       hashes cause the PCR to be extended with both  hashes.   Multiple  same
29       PCR  values  cause the PCR to be extended multiple times.  Extension is
30       done in order from left to right as specified.  At most 5  hash  exten‐
31       sions per PCR entry are supported.  This is to keep the parser simple.
32

OPTIONS

34       This tool accepts no tool specific options.
35

COMMON OPTIONS

37       This  collection of options are common to many programs and provide in‐
38       formation that many users may expect.
39
40       • -h, --help=[man|no-man]: Display the tools manpage.  By  default,  it
41         attempts  to  invoke  the  manpager for the tool, however, on failure
42         will output a short tool summary.  This is the same behavior  if  the
43         “man”  option argument is specified, however if explicit “man” is re‐
44         quested, the tool will provide errors from man  on  stderr.   If  the
45         “no-man”  option  if  specified, or the manpager fails, the short op‐
46         tions will be output to stdout.
47
48         To successfully use the manpages feature requires the manpages to  be
49         installed or on MANPATH, See man(1) for more details.
50
51       • -v,  --version:  Display version information for this tool, supported
52         tctis and exit.
53
54       • -V, --verbose: Increase the information that the tool prints  to  the
55         console  during  its  execution.  When using this option the file and
56         line number are printed.
57
58       • -Q, --quiet: Silence normal tool output to stdout.
59
60       • -Z, --enable-errata: Enable the application of errata fixups.  Useful
61         if  an  errata fixup needs to be applied to commands sent to the TPM.
62         Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.
63

TCTI Configuration

65       The TCTI or “Transmission Interface”  is  the  communication  mechanism
66       with  the TPM.  TCTIs can be changed for communication with TPMs across
67       different mediums.
68
69       To control the TCTI, the tools respect:
70
71       1. The command line option -T or --tcti
72
73       2. The environment variable: TPM2TOOLS_TCTI.
74
75       Note: The command line option always overrides  the  environment  vari‐
76       able.
77
78       The current known TCTIs are:
79
80       • tabrmd      -     The     resource     manager,     called     tabrmd
81         (https://github.com/tpm2-software/tpm2-abrmd).  Note that tabrmd  and
82         abrmd as a tcti name are synonymous.
83
84       • mssim  - Typically used for communicating to the TPM software simula‐
85         tor.
86
87       • device - Used when talking directly to a TPM device file.
88
89       • none - Do not initalize a connection with the TPM.  Some tools  allow
90         for off-tpm options and thus support not using a TCTI.  Tools that do
91         not support it will error when attempted to be used  without  a  TCTI
92         connection.   Does  not  support ANY options and MUST BE presented as
93         the exact text of “none”.
94
95       The arguments to either the command  line  option  or  the  environment
96       variable are in the form:
97
98       <tcti-name>:<tcti-option-config>
99
100       Specifying  an  empty  string  for  either the <tcti-name> or <tcti-op‐
101       tion-config> results in the default being used for that portion respec‐
102       tively.
103
104   TCTI Defaults
105       When  a  TCTI  is not specified, the default TCTI is searched for using
106       dlopen(3) semantics.  The tools will  search  for  tabrmd,  device  and
107       mssim  TCTIs  IN THAT ORDER and USE THE FIRST ONE FOUND.  You can query
108       what TCTI will be chosen as the default by using the -v option to print
109       the  version information.  The “default-tcti” key-value pair will indi‐
110       cate which of the aforementioned TCTIs is the default.
111
112   Custom TCTIs
113       Any TCTI that implements the dynamic TCTI interface can be loaded.  The
114       tools internally use dlopen(3), and the raw tcti-name value is used for
115       the lookup.  Thus, this could be a path to the shared library, or a li‐
116       brary name as understood by dlopen(3) semantics.
117

TCTI OPTIONS

119       This collection of options are used to configure the various known TCTI
120       modules available:
121
122       • device: For the device TCTI, the TPM character device file for use by
123         the device TCTI can be specified.  The default is /dev/tpm0.
124
125         Example:    -T   device:/dev/tpm0   or   export   TPM2TOOLS_TCTI=“de‐
126         vice:/dev/tpm0”
127
128       • mssim: For the mssim TCTI, the domain name or  IP  address  and  port
129         number  used  by  the  simulator  can  be specified.  The default are
130         127.0.0.1 and 2321.
131
132         Example: -T mssim:host=localhost,port=2321  or  export  TPM2TOOLS_TC‐
133         TI=“mssim:host=localhost,port=2321”
134
135       • abrmd:  For  the abrmd TCTI, the configuration string format is a se‐
136         ries of simple key value pairs separated by a  `,'  character.   Each
137         key and value string are separated by a `=' character.
138
139         • TCTI abrmd supports two keys:
140
141           1. `bus_name'  :  The  name  of  the  tabrmd  service on the bus (a
142              string).
143
144           2. `bus_type' : The type of the dbus instance (a string) limited to
145              `session' and `system'.
146
147         Specify  the tabrmd tcti name and a config string of bus_name=com.ex‐
148         ample.FooBar:
149
150                \--tcti=tabrmd:bus_name=com.example.FooBar
151
152         Specify the default (abrmd) tcti and a config string of bus_type=ses‐
153         sion:
154
155                \--tcti:bus_type=session
156
157         NOTE: abrmd and tabrmd are synonymous.
158
159       PCR bank specifiers (common/pcr.md)
160

EXAMPLES

162   Extend PCR 4’s SHA1 bank with a hash
163              tpm2_pcrextend 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
164
165   Extend PCR 4’s SHA1 and SHA256 banks with hashes
166              tpm2_pcrextend 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15,sha256=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
167
168   Extend PCR 4’s SHA1 and PCR 7’s SHA256 bank with hashes
169              tpm2_pcrextend 4:sha1=f1d2d2f924e986ac86fdf7b36c94bcdf32beec15 7:sha256=b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
170

Returns

172       Tools can return any of the following codes:
173
174       • 0 - Success.
175
176       • 1 - General non-specific error.
177
178       • 2 - Options handling error.
179
180       • 3 - Authentication error.
181
182       • 4 - TCTI related error.
183
184       • 5 - Non supported scheme.  Applicable to tpm2_testparams.
185

BUGS

187       Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
188

HELP

190       See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
191
192
193
194tpm2-tools                                                   tpm2_pcrextend(1)