tpm_nvdefine(8)

💖 tpm_nvdefine — the manual page, but make it make sense 💖

okay bestie, pull up a chair, we're talking about tpm_nvdefine from the TPM Management set (section 8 of the manual, if you're keeping score). this is the girl who creates NVRAM areas. she's a builder. a founder. main character energy fr fr.

---

🌸 NAME 🌸

tpm_nvdefine — she defines things. specifically NVRAM areas. that's her whole thing. periodt.

---

✨ SYNOPSIS ✨

tpm_nvdefine [OPTIONS]

just the command and your options, no positional args, no drama. 🎀

---

🦋 DESCRIPTION 🦋

so here's the tea: tpm_nvdefine defines a new NVRAM area at the index you give it, with the size you give it. that's it, that's the job. 💅

but — and this is important — you have to provide the permissions that control access to that NVRAM area. no permissions, no vibes, no area. you're the one setting the rules, so set them thoughtfully.

also, owner authentication is necessary once the NVRAM area 0xFFFFFFFF has been defined. and you can hand over the owner password right there on the command line using the owner password option. convenient? yes. but bestie, it's right there in your shell history, so like… be aware. 😭

these are all the options she supports, and yes we're going through every single one:

• -h, --help — shows you the command usage info. your little map. 🗺️
• -v, --version — shows the command version info. for when you need to know which her you're talking to.
• -l, --log [none|error|info|debug] — sets the logging level. pick your volume: none, error, info, or debug.
• -u, --unicode — use TSS UNICODE encoding for passwords, so you play nice with applications using TSS popup boxes. compatibility queen 🫶
• -y, --owner-well-known — use a secret of all zeros (20 bytes of zeros) as the owner's secret. yes, literally 20 bytes of zeros. iconic in a concerning way.
• -z, --data-well-known — use a secret of all zeros (20 bytes of zeros) as the NVRAM area's secret. same energy, different secret. 🙈
• -o, --pwdo (optional parameter) — the owner password.

you can hand it over directly, like --pwdo=password or -opassword. and if you don't pass a password with this option, the program will prompt you for it. so no pressure, she'll ask. 💜

• -a, --pwda (optional parameter) — the NVRAM area password.

same deal: give it directly with --pwda=password or -apassword, or leave it out and she'll prompt you for the password. 🍓

• -i, --index — the index of the NVRAM area. the parameter must either be a decimal number or a hexadecimal number starting with 0x.

so like, to select the NVRAM area with index 0x100, your command line parameter should be -i 0x100 or --index 0x100. see? cute and easy. ✨

• -s, --size — the size of the NVRAM area. again: decimal number, or hexadecimal number starting with 0x. pick your base, babe.
• -r, --rpcsr — PCRs to seal the NVRAM area to for reading. use it multiple times if you've got multiple. 🔥
• -w, --wpcrs — PCRs to seal the NVRAM area to for writing. also multiple-use. she's flexible.
• -f, --filename — file containing PCR info for the NVRAM area. 📁
• -p, --permissions — the access permissions associated with the NVRAM area. the parameter must either be a decimal number or a hexadecimal number starting with 0x. and here's the fun part: it is possible to logically 'or' numbers or strings. the following strings are supported:
  • AUTHREAD — reading requires NVRAM area authorization.
  • AUTHWRITE — writing requires NVRAM area authorization.
  • PPREAD — reading requires physical presence.
  • PPWRITE — writing requires physical presence.
  • OWNERREAD — reading requires owner authorization.
  • OWNERWRITE — writing requires owner authorization.
  • GLOBALLOCK — a write to index 0 locks the NVRAM area until the next TPM_Startup(ST_CLEAR).
  • READ_STCLEAR — a read with size 0 on the same index prevents further reading until the next TPM_Startup(ST_CLEAR).
  • WRITE_STCLEAR — a write with size 0 to the same index prevents further writing until the next TPM_Startup(ST_CLEAR).
  • WRITEDEFINE — a write with size 0 to the same index locks the NVRAM area permanently. like, forever-forever. no takebacks. 💀
  • WRITEALL — the value must be written in a single operation.

and an example of a permission parameter, so you can see it in the wild:

--permissions="OWNERREAD|OWNERWRITE"

see how she or'd them? obsessed. 👑

---

🌈 SEE ALSO 🌈

go read her friends, they're all lovely:

• tpm_nvread(8)
• tpm_nvwrite(8)
• tpm_nvrelease(8)
• tpm_nvinfo(8)

---

😭 REPORTING BUGS 😭

found a bug? not her fault but also please tell her. report bugs to <trousers-users@lists.sourceforge.net>. she'll appreciate you fr fr.

---

okay that's the whole page, you ate that, go define some NVRAM areas responsibly bestie 💅✨

this page came from TPM Management, dated 2011-07-07, and yeah — it's tpm_nvdefine(8), section 8, in all her glory. mwah. 🎀