1tpm2(1)                     General Commands Manual                    tpm2(1)
2
3
4

NAME

6       tpm2(1)   -  A  single  small  executable  that  combines  the  various
7       tpm2-tools much like a BusyBox that provides a fairly complete environ‐
8       ment for any small or embedded system.
9

SYNOPSIS

11       tpm2 [OPTIONS] [ARGUMENTS]
12

DESCRIPTION

14       tpm2(1) - To ease installation of tpm2-tools in initrd or embedded sys‐
15       tems where size-optimization and limited resources are important, it is
16       convenient  to  have  a single executable that can dispatch the various
17       TPM2 functionalities specified by the argument  which  is  one  of  the
18       available tool names.
19
20       The  options and arguments that follow are either the common options or
21       those specific to the tool name.
22
23       It is important to note that individual tools  with  prefix  tpm2_  can
24       still  be  invoked, however, they are now soft-linked to this tpm2 exe‐
25       cutable.  And so unlike BusyBox, full functionality of  the  individual
26       tools  is  available  in the executable.  For example: tpm2_getrandom 8
27       can alternatively be specified as tpm2 getrandom 8.
28

ARGUMENTS

30       List of possible tool names.  NOTE: Specify only one of these.  Look at
31       examples.
32
33       certifyX509certutil
34
35       checkquote
36
37       eventlog
38
39       print
40
41       rc_decode
42
43       activatecredential
44
45       certify
46
47       changeauth
48
49       changeeps
50
51       changepps
52
53       clear
54
55       clearcontrol
56
57       clockrateadjust
58
59       create
60
61       createak
62
63       createek
64
65       createpolicy
66
67       setprimarypolicy
68
69       createprimary
70
71       dictionarylockout
72
73       duplicate
74
75       getcap
76
77       gettestresult
78
79       encryptdecrypt
80
81       evictcontrol
82
83       flushcontext
84
85       getekcertificate
86
87       getrandom
88
89       gettime
90
91       hash
92
93       hierarchycontrol
94
95       hmac
96
97       import
98
99       incrementalselftest
100
101       load
102
103       loadexternal
104
105       makecredential
106
107       nvdefine
108
109       nvextend
110
111       nvincrement
112
113       nvreadpublic
114
115       nvread
116
117       nvreadlock
118
119       nvundefine
120
121       nvwrite
122
123       nvwritelock
124
125       nvsetbits
126
127       pcrallocate
128
129       pcrevent
130
131       pcrextend
132
133       pcrread
134
135       pcrreset
136
137       policypcr
138
139       policyauthorize
140
141       policyauthorizenv
142
143       policynv
144
145       policycountertimer
146
147       policyor
148
149       policynamehash
150
151       policytemplate
152
153       policycphash
154
155       policypassword
156
157       policysigned
158
159       policyticket
160
161       policyauthvalue
162
163       policysecret
164
165       policyrestart
166
167       policycommandcode
168
169       policynvwritten
170
171       policyduplicationselect
172
173       policylocality
174
175       quote
176
177       readclock
178
179       readpublic
180
181       rsadecrypt
182
183       rsaencrypt
184
185       send
186
187       selftest
188
189       sessionconfig
190
191       setclock
192
193       shutdown
194
195       sign
196
197       certifycreation
198
199       nvcertify
200
201       startauthsession
202
203       startup
204
205       stirrandom
206
207       testparms
208
209       unseal
210
211       verifysignature
212
213       setcommandauditstatus
214
215       getcommandauditdigest
216
217       getsessionauditdigest
218
219       geteccparameters
220
221       ecephemeral
222
223       commit
224
225       ecdhkeygen
226
227       ecdhzgen
228
229       zgen2phase
230
231   References

COMMON OPTIONS

233       This  collection of options are common to many programs and provide in‐
234       formation that many users may expect.
235
236-h, --help=[man|no-man]: Display the tools manpage.  By  default,  it
237         attempts  to  invoke  the  manpager for the tool, however, on failure
238         will output a short tool summary.  This is the same behavior  if  the
239         “man”  option argument is specified, however if explicit “man” is re‐
240         quested, the tool will provide errors from man  on  stderr.   If  the
241         “no-man”  option  if  specified, or the manpager fails, the short op‐
242         tions will be output to stdout.
243
244         To successfully use the manpages feature requires the manpages to  be
245         installed or on MANPATH, See man(1) for more details.
246
247-v,  --version:  Display version information for this tool, supported
248         tctis and exit.
249
250-V, --verbose: Increase the information that the tool prints  to  the
251         console  during  its  execution.  When using this option the file and
252         line number are printed.
253
254-Q, --quiet: Silence normal tool output to stdout.
255
256-Z, --enable-errata: Enable the application of errata fixups.  Useful
257         if  an  errata fixup needs to be applied to commands sent to the TPM.
258         Defining the environment TPM2TOOLS_ENABLE_ERRATA is equivalent.   in‐
259         formation many users may expect.
260

TCTI Configuration

262       The  TCTI  or  “Transmission  Interface” is the communication mechanism
263       with the TPM.  TCTIs can be changed for communication with TPMs  across
264       different mediums.
265
266       To control the TCTI, the tools respect:
267
268       1. The command line option -T or --tcti
269
270       2. The environment variable: TPM2TOOLS_TCTI.
271
272       Note:  The  command  line option always overrides the environment vari‐
273       able.
274
275       The current known TCTIs are:
276
277       • tabrmd     -     The     resource     manager,     called      tabrmd
278         (https://github.com/tpm2-software/tpm2-abrmd).   Note that tabrmd and
279         abrmd as a tcti name are synonymous.
280
281       • mssim - Typically used for communicating to the TPM software  simula‐
282         tor.
283
284       • device - Used when talking directly to a TPM device file.
285
286       • none  - Do not initalize a connection with the TPM.  Some tools allow
287         for off-tpm options and thus support not using a TCTI.  Tools that do
288         not  support  it  will error when attempted to be used without a TCTI
289         connection.  Does not support ANY options and MUST  BE  presented  as
290         the exact text of “none”.
291
292       The  arguments  to  either  the  command line option or the environment
293       variable are in the form:
294
295       <tcti-name>:<tcti-option-config>
296
297       Specifying an empty string for  either  the  <tcti-name>  or  <tcti-op‐
298       tion-config> results in the default being used for that portion respec‐
299       tively.
300
301   TCTI Defaults
302       When a TCTI is not specified, the default TCTI is  searched  for  using
303       dlopen(3)  semantics.   The  tools  will  search for tabrmd, device and
304       mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND.  You  can  query
305       what TCTI will be chosen as the default by using the -v option to print
306       the version information.  The “default-tcti” key-value pair will  indi‐
307       cate which of the aforementioned TCTIs is the default.
308
309   Custom TCTIs
310       Any TCTI that implements the dynamic TCTI interface can be loaded.  The
311       tools internally use dlopen(3), and the raw tcti-name value is used for
312       the lookup.  Thus, this could be a path to the shared library, or a li‐
313       brary name as understood by dlopen(3) semantics.
314

TCTI OPTIONS

316       This collection of options are used to configure the various known TCTI
317       modules available:
318
319device: For the device TCTI, the TPM character device file for use by
320         the device TCTI can be specified.  The default is /dev/tpm0.
321
322         Example:   -T   device:/dev/tpm0   or   export    TPM2TOOLS_TCTI=“de‐
323         vice:/dev/tpm0”
324
325mssim:  For  the  mssim  TCTI, the domain name or IP address and port
326         number used by the simulator  can  be  specified.   The  default  are
327         127.0.0.1 and 2321.
328
329         Example:  -T  mssim:host=localhost,port=2321  or export TPM2TOOLS_TC‐
330         TI=“mssim:host=localhost,port=2321”
331
332abrmd: For the abrmd TCTI, the configuration string format is  a  se‐
333         ries  of  simple  key value pairs separated by a `,' character.  Each
334         key and value string are separated by a `=' character.
335
336         • TCTI abrmd supports two keys:
337
338           1. `bus_name' : The name of  the  tabrmd  service  on  the  bus  (a
339              string).
340
341           2. `bus_type' : The type of the dbus instance (a string) limited to
342              `session' and `system'.
343
344         Specify the tabrmd tcti name and a config string of  bus_name=com.ex‐
345         ample.FooBar:
346
347                \--tcti=tabrmd:bus_name=com.example.FooBar
348
349         Specify the default (abrmd) tcti and a config string of bus_type=ses‐
350         sion:
351
352                \--tcti:bus_type=session
353
354         NOTE: abrmd and tabrmd are synonymous.  the various known  TCTI  mod‐
355         ules.
356

EXAMPLES

358   Get 8 rand bytes from the TPM
359              tpm2 getrandom 8 | xxd -p
360
361   Send a TPM Startup Command with flags TPM2_SU_CLEAR
362              tpm2 startup -c
363

Returns

365       Tools can return any of the following codes:
366
367       • 0 - Success.
368
369       • 1 - General non-specific error.
370
371       • 2 - Options handling error.
372
373       • 3 - Authentication error.
374
375       • 4 - TCTI related error.
376
377       • 5 - Non supported scheme.  Applicable to tpm2_testparams.
378

BUGS

380       Github Issues (https://github.com/tpm2-software/tpm2-tools/issues)
381

HELP

383       See the Mailing List (https://lists.linuxfoundation.org/mailman/listin
384       fo/tpm2)
385
386
387
388tpm2-tools                                                             tpm2(1)
Impressum