tpm2_send(1)

📦
version 5.8 · 10 versions
, in arch rolling

💖 tpm2_send(1) — General Commands Manual (yes bestie, that's the whole vibe) 💖

Okay so this is tpm2_send(1) from the General Commands Manual, and honestly it's giving "raw unfiltered TPM energy" — let's get into it 🫶

✨ NAME ✨

tpm2_send(1) — literally just: send a raw command buffer to the TPM. That's it. That's the whole gig 💅

🌸 SYNOPSIS 🌸

tpm2_send [OPTIONS] [STDIN]

🦋 DESCRIPTION 🦋

So tpm2_send(1) sends a TPM command to the TPM, periodt. The command gets read from a file as a binary stream, then transmitted to the TPM using the TCTI that the caller specified. Whatever the TPM sends back — the response — gets written to the output file.

Lowkey, you're probably gonna want to redirect that output somewhere: into a file, or straight into a program that decodes it and shows the response in human-readable form. That's the main character move here 👑

🎀 OPTIONS 🎀

  • -o, --output=FILE — the output file where the response buffer gets sent. Defaults to STDOUT. (So if you say nothing, it just yeets it at your terminal 🙈)
  • _STDIN — the file containing the TPM2 command. That's your input, bestie.

📚 References

(That's the subsection, no cap — nothing extra hiding in here.)

💜 COMMON OPTIONS 💜

This little collection of options is common to many programs, and it provides info that a lot of users just… expect to be there. It's the standard bestie starter pack ✨

  • -h, --help=[man|no-man] — displays the tool's manpage. By default it tries to invoke the manpager for the tool, but if that fails it'll output a short tool summary instead. Same behavior if you pass the man option argument — except if you explicitly ask for man, the tool will actually give you the errors from man on stderr. If you specify the no-man option, or the manpager just fails, the short options get output to stdout.
Just so you know 🫶 — for the manpages feature to actually work, the manpages need to be installed or on MANPATH. See man(1) for more details.
  • -v, --version — displays version information for this tool plus the supported tctis, then exits. Slay.
  • -V, --verbose — increases the info the tool prints to the console while it's running. When you use this option, the file and line number get printed too. iykyk 🔍
  • -Q, --quiet — silences normal tool output to stdout. Shhh 🤫
  • -Z, --enable-errata — enables the application of errata fixups. Useful if an errata fixup needs to be applied to commands sent to the TPM. Defining the environment variable TPM2TOOLS_ENABLE_ERRATA is equivalent. Two paths, same destination 💫
  • -z, --pwd-session — uses a password session instead of a HMAC session for authentication. A clear text password is passed to the TPM to authorize the action. This option can be used to avoid problems when unsalted sessions are used in OpenSSL FIPS mode. If auth values are used, a salted session should be used for authentication. (Read that last bit again, bestie — it matters 💀)
  • -R, --autoflush — enables autoflush for transient objects created by the command. If a parent object is loaded from a context file, then also the transient parent object will be flushed. Autoflush can also be activated if the environment variable TPM2TOOLS_AUTOFLUSH is set to yes or true. Here's that info many users may expect 🌈

🌼 TCTI Configuration 🌼

The TCTI — aka the "Transmission Interface" — is the communication mechanism with the TPM. TCTIs can be changed so you can talk to TPMs across different mediums. Versatile icon 💅

To control the TCTI, the tools respect:

  1. The command line option -T or --tcti
  2. The environment variable: TPM2TOOLS_TCTI.
Note: the command line option always overrides the environment variable. No negotiating 👑

The current known TCTIs are:

  • tabrmd — the resource manager, called tabrmd. Note that tabrmd and abrmd as a tcti name are synonymous.
  • mssim — typically used for communicating to the TPM software simulator.
  • device — used when talking directly to a TPM device file.
  • none — do not initalize a connection with the TPM. Some tools allow for off-tpm options and thus support not using a TCTI. Tools that don't support it will error when you try to use them without a TCTI connection. Does not support ANY options and MUST BE presented as the exact text of none.

The arguments to either the command line option or the environment variable are in the form:

<tcti-name>:<tcti-option-config>

Specifying an empty string for either the <tcti-name> or <tcti-option-config> results in the default being used for that portion respectively. Cute and forgiving 🎀

🧚 TCTI Defaults

When a TCTI isn't specified, the default TCTI is searched for using dlopen(3) semantics. The tools will search for tabrmd, device and mssim TCTIs IN THAT ORDER and USE THE FIRST ONE FOUND — yes, the caps are doing their job, that's the actual emphasis 😭

You can query what TCTI will be chosen as the default by using the -v option to print the version information. The default-tcti key-value pair will tell you which of the aforementioned TCTIs is the default. Peek at your future, bestie 🔮

⭐ Custom TCTIs

Any TCTI that implements the dynamic TCTI interface can be loaded. The tools internally use dlopen(3), and the raw tcti-name value is used for the lookup. So that could be a path to the shared library, or a library name as understood by dlopen(3) semantics. Bring your own, we love a guest appearance 🌟

💀 TCTI OPTIONS 💀

This collection of options is used to configure the various known TCTI modules available:

  • device — for the device TCTI, the TPM character device file for use by the device TCTI can be specified. The default is /dev/tpm0.

Example: -T device:/dev/tpm0 or export TPM2TOOLS_TCTI="device:/dev/tpm0"

  • mssim — for the mssim TCTI, the domain name or IP address and port number used by the simulator can be specified. The default are 127.0.0.1 and 2321.

Example: -T mssim:host=localhost,port=2321 or export TPM2TOOLS_TCTI="mssim:host=localhost,port=2321"

  • abrmd — for the abrmd TCTI, the configuration string format is a series of simple key value pairs separated by a , character. Each key and value string are separated by a = character.
    • TCTI abrmd supports two keys:
      1. bus_name : the name of the tabrmd service on the bus (a string).
      2. bus_type : the type of the dbus instance (a string) limited to session and system.

Specify the tabrmd tcti name and a config string of bus_name=com.example.FooBar:

\--tcti=tabrmd:bus_name=com.example.FooBar

Specify the default (abrmd) tcti and a config string of bus_type=session:

\--tcti:bus_type=session
NOTE: abrmd and tabrmd are synonymous. Also, that's the various known TCTI modules. 🙈

🔥 EXAMPLES 🔥

💫 Send and receive raw commands to TPM

Send the contents of tpm2-command.bin to a device and collect the response as tpm2-response.bin. Watch her work:

tpm2_send < tpm2-command.bin > tpm2-response.bin

tpm2_send < tpm2-command.bin -o tpm2-response.bin

Two ways, same energy. Do it with shell redirection or do it with -o — your call, both slay 🎀

🍓 Returns 🍓

Tools can return any of the following codes:

  • 0 — Success. We love to see it 💖
  • 1 — General non-specific error. Vague, unhelpful, but real.
  • 2 — Options handling error.
  • 3 — Authentication error. Locked out, bestie 😭
  • 4 — TCTI related error.
  • 5 — Non supported scheme. Applicable to tpm2_testparams.

🐛 BUGS 🐛

Github Issues. That's it, that's the whole bug section. Take it up with the issues page 🫶

📣 HELP 📣

See the Mailing List.

📜 License 📜

This work is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0). Respect the license, bestie 💜

And that's the whole page!! 🦋 This came to you from tpm2-tools — the source/version behind everything you just read — with tpm2_send(1) as the manpage name riding along at the bottom, exactly like the original footer (no date printed on this one, so no date to gossip about 🙈). Go send some raw commands, you absolute icon 👑✨

📦 where this page comes from