2 This library is used by other modules to send TPM2 command.
4 Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved. <BR>
5 SPDX-License-Identifier: BSD-2-Clause-Patent
9 #ifndef _TPM2_COMMAND_LIB_H_
10 #define _TPM2_COMMAND_LIB_H_
12 #include <IndustryStandard/Tpm20.h>
15 This command starts a hash or an Event sequence.
16 If hashAlg is an implemented hash, then a hash sequence is started.
17 If hashAlg is TPM_ALG_NULL, then an Event sequence is started.
19 @param[in] HashAlg The hash algorithm to use for the hash sequence
20 An Event sequence starts if this is TPM_ALG_NULL.
21 @param[out] SequenceHandle A handle to reference the sequence
23 @retval EFI_SUCCESS Operation completed successfully.
24 @retval EFI_DEVICE_ERROR Unexpected device behavior.
28 Tpm2HashSequenceStart (
29 IN TPMI_ALG_HASH HashAlg
,
30 OUT TPMI_DH_OBJECT
*SequenceHandle
34 This command is used to add data to a hash or HMAC sequence.
35 The amount of data in buffer may be any size up to the limits of the TPM.
36 NOTE: In all TPM, a buffer size of 1,024 octets is allowed.
38 @param[in] SequenceHandle Handle for the sequence object
39 @param[in] Buffer Data to be added to hash
41 @retval EFI_SUCCESS Operation completed successfully.
42 @retval EFI_DEVICE_ERROR Unexpected device behavior.
47 IN TPMI_DH_OBJECT SequenceHandle
,
48 IN TPM2B_MAX_BUFFER
*Buffer
52 This command adds the last part of data, if any, to an Event sequence and returns the result in a digest list.
53 If pcrHandle references a PCR and not TPM_RH_NULL, then the returned digest list is processed in
54 the same manner as the digest list input parameter to TPM2_PCR_Extend() with the pcrHandle in each
55 bank extended with the associated digest value.
57 @param[in] PcrHandle PCR to be extended with the Event data
58 @param[in] SequenceHandle Authorization for the sequence
59 @param[in] Buffer Data to be added to the Event
60 @param[out] Results List of digests computed for the PCR
62 @retval EFI_SUCCESS Operation completed successfully.
63 @retval EFI_DEVICE_ERROR Unexpected device behavior.
67 Tpm2EventSequenceComplete (
68 IN TPMI_DH_PCR PcrHandle
,
69 IN TPMI_DH_OBJECT SequenceHandle
,
70 IN TPM2B_MAX_BUFFER
*Buffer
,
71 OUT TPML_DIGEST_VALUES
*Results
75 This command adds the last part of data, if any, to a hash/HMAC sequence and returns the result.
77 @param[in] SequenceHandle Authorization for the sequence
78 @param[in] Buffer Data to be added to the hash/HMAC
79 @param[out] Result The returned HMAC or digest in a sized buffer
81 @retval EFI_SUCCESS Operation completed successfully.
82 @retval EFI_DEVICE_ERROR Unexpected device behavior.
86 Tpm2SequenceComplete (
87 IN TPMI_DH_OBJECT SequenceHandle
,
88 IN TPM2B_MAX_BUFFER
*Buffer
,
89 OUT TPM2B_DIGEST
*Result
93 Send Startup command to TPM2.
95 @param[in] StartupType TPM_SU_CLEAR or TPM_SU_STATE
97 @retval EFI_SUCCESS Operation completed successfully.
98 @retval EFI_DEVICE_ERROR Unexpected device behavior.
103 IN TPM_SU StartupType
107 Send Shutdown command to TPM2.
109 @param[in] ShutdownType TPM_SU_CLEAR or TPM_SU_STATE.
111 @retval EFI_SUCCESS Operation completed successfully.
112 @retval EFI_DEVICE_ERROR Unexpected device behavior.
117 IN TPM_SU ShutdownType
121 This command causes the TPM to perform a test of its capabilities.
122 If the fullTest is YES, the TPM will test all functions.
123 If fullTest = NO, the TPM will only test those functions that have not previously been tested.
125 @param[in] FullTest YES if full test to be performed
126 NO if only test of untested functions required
128 @retval EFI_SUCCESS Operation completed successfully.
129 @retval EFI_DEVICE_ERROR Unexpected device behavior.
134 IN TPMI_YES_NO FullTest
138 This command allows setting of the authorization policy for the platform hierarchy (platformPolicy), the
139 storage hierarchy (ownerPolicy), and and the endorsement hierarchy (endorsementPolicy).
141 @param[in] AuthHandle TPM_RH_ENDORSEMENT, TPM_RH_OWNER or TPM_RH_PLATFORM+{PP} parameters to be validated
142 @param[in] AuthSession Auth Session context
143 @param[in] AuthPolicy An authorization policy hash
144 @param[in] HashAlg The hash algorithm to use for the policy
146 @retval EFI_SUCCESS Operation completed successfully.
147 @retval EFI_DEVICE_ERROR Unexpected device behavior.
151 Tpm2SetPrimaryPolicy (
152 IN TPMI_RH_HIERARCHY_AUTH AuthHandle
,
153 IN TPMS_AUTH_COMMAND
*AuthSession
,
154 IN TPM2B_DIGEST
*AuthPolicy
,
155 IN TPMI_ALG_HASH HashAlg
159 This command removes all TPM context associated with a specific Owner.
161 @param[in] AuthHandle TPM_RH_LOCKOUT or TPM_RH_PLATFORM+{PP}
162 @param[in] AuthSession Auth Session context
164 @retval EFI_SUCCESS Operation completed successfully.
165 @retval EFI_DEVICE_ERROR Unexpected device behavior.
170 IN TPMI_RH_CLEAR AuthHandle
,
171 IN TPMS_AUTH_COMMAND
*AuthSession OPTIONAL
175 Disables and enables the execution of TPM2_Clear().
177 @param[in] AuthHandle TPM_RH_LOCKOUT or TPM_RH_PLATFORM+{PP}
178 @param[in] AuthSession Auth Session context
179 @param[in] Disable YES if the disableOwnerClear flag is to be SET,
180 NO if the flag is to be CLEAR.
182 @retval EFI_SUCCESS Operation completed successfully.
183 @retval EFI_DEVICE_ERROR Unexpected device behavior.
188 IN TPMI_RH_CLEAR AuthHandle
,
189 IN TPMS_AUTH_COMMAND
*AuthSession
, OPTIONAL
190 IN TPMI_YES_NO Disable
194 This command allows the authorization secret for a hierarchy or lockout to be changed using the current
195 authorization value as the command authorization.
197 @param[in] AuthHandle TPM_RH_LOCKOUT, TPM_RH_ENDORSEMENT, TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}
198 @param[in] AuthSession Auth Session context
199 @param[in] NewAuth New authorization secret
201 @retval EFI_SUCCESS Operation completed successfully.
202 @retval EFI_DEVICE_ERROR Unexpected device behavior.
206 Tpm2HierarchyChangeAuth (
207 IN TPMI_RH_HIERARCHY_AUTH AuthHandle
,
208 IN TPMS_AUTH_COMMAND
*AuthSession
,
209 IN TPM2B_AUTH
*NewAuth
213 This replaces the current EPS with a value from the RNG and sets the Endorsement hierarchy controls to
214 their default initialization values.
216 @param[in] AuthHandle TPM_RH_PLATFORM+{PP}
217 @param[in] AuthSession Auth Session context
219 @retval EFI_SUCCESS Operation completed successfully.
220 @retval EFI_DEVICE_ERROR Unexpected device behavior.
225 IN TPMI_RH_PLATFORM AuthHandle
,
226 IN TPMS_AUTH_COMMAND
*AuthSession
230 This replaces the current PPS with a value from the RNG and sets platformPolicy to the default
231 initialization value (the Empty Buffer).
233 @param[in] AuthHandle TPM_RH_PLATFORM+{PP}
234 @param[in] AuthSession Auth Session context
236 @retval EFI_SUCCESS Operation completed successfully.
237 @retval EFI_DEVICE_ERROR Unexpected device behavior.
242 IN TPMI_RH_PLATFORM AuthHandle
,
243 IN TPMS_AUTH_COMMAND
*AuthSession
247 This command enables and disables use of a hierarchy.
249 @param[in] AuthHandle TPM_RH_ENDORSEMENT, TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}
250 @param[in] AuthSession Auth Session context
251 @param[in] Hierarchy Hierarchy of the enable being modified
252 @param[in] State YES if the enable should be SET,
253 NO if the enable should be CLEAR
255 @retval EFI_SUCCESS Operation completed successfully.
256 @retval EFI_DEVICE_ERROR Unexpected device behavior.
260 Tpm2HierarchyControl (
261 IN TPMI_RH_HIERARCHY AuthHandle
,
262 IN TPMS_AUTH_COMMAND
*AuthSession
,
263 IN TPMI_RH_HIERARCHY Hierarchy
,
268 This command cancels the effect of a TPM lockout due to a number of successive authorization failures.
269 If this command is properly authorized, the lockout counter is set to zero.
271 @param[in] LockHandle LockHandle
272 @param[in] AuthSession Auth Session context
274 @retval EFI_SUCCESS Operation completed successfully.
275 @retval EFI_DEVICE_ERROR Unexpected device behavior.
279 Tpm2DictionaryAttackLockReset (
280 IN TPMI_RH_LOCKOUT LockHandle
,
281 IN TPMS_AUTH_COMMAND
*AuthSession
285 This command cancels the effect of a TPM lockout due to a number of successive authorization failures.
286 If this command is properly authorized, the lockout counter is set to zero.
288 @param[in] LockHandle LockHandle
289 @param[in] AuthSession Auth Session context
290 @param[in] NewMaxTries Count of authorization failures before the lockout is imposed
291 @param[in] NewRecoveryTime Time in seconds before the authorization failure count is automatically decremented
292 @param[in] LockoutRecovery Time in seconds after a lockoutAuth failure before use of lockoutAuth is allowed
294 @retval EFI_SUCCESS Operation completed successfully.
295 @retval EFI_DEVICE_ERROR Unexpected device behavior.
299 Tpm2DictionaryAttackParameters (
300 IN TPMI_RH_LOCKOUT LockHandle
,
301 IN TPMS_AUTH_COMMAND
*AuthSession
,
302 IN UINT32 NewMaxTries
,
303 IN UINT32 NewRecoveryTime
,
304 IN UINT32 LockoutRecovery
308 This command is used to read the public area and Name of an NV Index.
310 @param[in] NvIndex The NV Index.
311 @param[out] NvPublic The public area of the index.
312 @param[out] NvName The Name of the nvIndex.
314 @retval EFI_SUCCESS Operation completed successfully.
315 @retval EFI_DEVICE_ERROR The command was unsuccessful.
320 IN TPMI_RH_NV_INDEX NvIndex
,
321 OUT TPM2B_NV_PUBLIC
*NvPublic
,
322 OUT TPM2B_NAME
*NvName
326 This command defines the attributes of an NV Index and causes the TPM to
327 reserve space to hold the data associated with the index.
328 If a definition already exists at the index, the TPM will return TPM_RC_NV_DEFINED.
330 @param[in] AuthHandle TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}.
331 @param[in] AuthSession Auth Session context
332 @param[in] Auth The authorization data.
333 @param[in] NvPublic The public area of the index.
335 @retval EFI_SUCCESS Operation completed successfully.
336 @retval EFI_DEVICE_ERROR The command was unsuccessful.
337 @retval EFI_ALREADY_STARTED The command was returned successfully, but NvIndex is already defined.
342 IN TPMI_RH_PROVISION AuthHandle
,
343 IN TPMS_AUTH_COMMAND
*AuthSession
, OPTIONAL
345 IN TPM2B_NV_PUBLIC
*NvPublic
349 This command removes an index from the TPM.
351 @param[in] AuthHandle TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}.
352 @param[in] NvIndex The NV Index.
353 @param[in] AuthSession Auth Session context
355 @retval EFI_SUCCESS Operation completed successfully.
356 @retval EFI_DEVICE_ERROR The command was unsuccessful.
357 @retval EFI_NOT_FOUND The command was returned successfully, but NvIndex is not found.
361 Tpm2NvUndefineSpace (
362 IN TPMI_RH_PROVISION AuthHandle
,
363 IN TPMI_RH_NV_INDEX NvIndex
,
364 IN TPMS_AUTH_COMMAND
*AuthSession OPTIONAL
368 This command reads a value from an area in NV memory previously defined by TPM2_NV_DefineSpace().
370 @param[in] AuthHandle the handle indicating the source of the authorization value.
371 @param[in] NvIndex The index to be read.
372 @param[in] AuthSession Auth Session context
373 @param[in] Size Number of bytes to read.
374 @param[in] Offset Byte offset into the area.
375 @param[in,out] OutData The data read.
377 @retval EFI_SUCCESS Operation completed successfully.
378 @retval EFI_DEVICE_ERROR The command was unsuccessful.
379 @retval EFI_NOT_FOUND The command was returned successfully, but NvIndex is not found.
384 IN TPMI_RH_NV_AUTH AuthHandle
,
385 IN TPMI_RH_NV_INDEX NvIndex
,
386 IN TPMS_AUTH_COMMAND
*AuthSession
, OPTIONAL
389 IN OUT TPM2B_MAX_BUFFER
*OutData
393 This command writes a value to an area in NV memory that was previously defined by TPM2_NV_DefineSpace().
395 @param[in] AuthHandle the handle indicating the source of the authorization value.
396 @param[in] NvIndex The NV Index of the area to write.
397 @param[in] AuthSession Auth Session context
398 @param[in] InData The data to write.
399 @param[in] Offset The offset into the NV Area.
401 @retval EFI_SUCCESS Operation completed successfully.
402 @retval EFI_DEVICE_ERROR The command was unsuccessful.
403 @retval EFI_NOT_FOUND The command was returned successfully, but NvIndex is not found.
408 IN TPMI_RH_NV_AUTH AuthHandle
,
409 IN TPMI_RH_NV_INDEX NvIndex
,
410 IN TPMS_AUTH_COMMAND
*AuthSession
, OPTIONAL
411 IN TPM2B_MAX_BUFFER
*InData
,
416 This command may be used to prevent further reads of the Index until the next TPM2_Startup (TPM_SU_CLEAR).
418 @param[in] AuthHandle the handle indicating the source of the authorization value.
419 @param[in] NvIndex The NV Index of the area to lock.
420 @param[in] AuthSession Auth Session context
422 @retval EFI_SUCCESS Operation completed successfully.
423 @retval EFI_DEVICE_ERROR The command was unsuccessful.
424 @retval EFI_NOT_FOUND The command was returned successfully, but NvIndex is not found.
429 IN TPMI_RH_NV_AUTH AuthHandle
,
430 IN TPMI_RH_NV_INDEX NvIndex
,
431 IN TPMS_AUTH_COMMAND
*AuthSession OPTIONAL
435 This command may be used to inhibit further writes of the Index.
437 @param[in] AuthHandle the handle indicating the source of the authorization value.
438 @param[in] NvIndex The NV Index of the area to lock.
439 @param[in] AuthSession Auth Session context
441 @retval EFI_SUCCESS Operation completed successfully.
442 @retval EFI_DEVICE_ERROR The command was unsuccessful.
443 @retval EFI_NOT_FOUND The command was returned successfully, but NvIndex is not found.
448 IN TPMI_RH_NV_AUTH AuthHandle
,
449 IN TPMI_RH_NV_INDEX NvIndex
,
450 IN TPMS_AUTH_COMMAND
*AuthSession OPTIONAL
454 The command will SET TPMA_NV_WRITELOCKED for all indexes that have their TPMA_NV_GLOBALLOCK attribute SET.
456 @param[in] AuthHandle TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}.
457 @param[in] AuthSession Auth Session context
459 @retval EFI_SUCCESS Operation completed successfully.
460 @retval EFI_DEVICE_ERROR The command was unsuccessful.
461 @retval EFI_NOT_FOUND The command was returned successfully, but NvIndex is not found.
465 Tpm2NvGlobalWriteLock (
466 IN TPMI_RH_PROVISION AuthHandle
,
467 IN TPMS_AUTH_COMMAND
*AuthSession OPTIONAL
471 This command is used to cause an update to the indicated PCR.
472 The digests parameter contains one or more tagged digest value identified by an algorithm ID.
473 For each digest, the PCR associated with pcrHandle is Extended into the bank identified by the tag (hashAlg).
475 @param[in] PcrHandle Handle of the PCR
476 @param[in] Digests List of tagged digest values to be extended
478 @retval EFI_SUCCESS Operation completed successfully.
479 @retval EFI_DEVICE_ERROR Unexpected device behavior.
484 IN TPMI_DH_PCR PcrHandle
,
485 IN TPML_DIGEST_VALUES
*Digests
489 This command is used to cause an update to the indicated PCR.
490 The data in eventData is hashed using the hash algorithm associated with each bank in which the
491 indicated PCR has been allocated. After the data is hashed, the digests list is returned. If the pcrHandle
492 references an implemented PCR and not TPM_ALG_NULL, digests list is processed as in
494 A TPM shall support an Event.size of zero through 1,024 inclusive.
496 @param[in] PcrHandle Handle of the PCR
497 @param[in] EventData Event data in sized buffer
498 @param[out] Digests List of digest
500 @retval EFI_SUCCESS Operation completed successfully.
501 @retval EFI_DEVICE_ERROR Unexpected device behavior.
506 IN TPMI_DH_PCR PcrHandle
,
507 IN TPM2B_EVENT
*EventData
,
508 OUT TPML_DIGEST_VALUES
*Digests
512 This command returns the values of all PCR specified in pcrSelect.
514 @param[in] PcrSelectionIn The selection of PCR to read.
515 @param[out] PcrUpdateCounter The current value of the PCR update counter.
516 @param[out] PcrSelectionOut The PCR in the returned list.
517 @param[out] PcrValues The contents of the PCR indicated in pcrSelect.
519 @retval EFI_SUCCESS Operation completed successfully.
520 @retval EFI_DEVICE_ERROR The command was unsuccessful.
525 IN TPML_PCR_SELECTION
*PcrSelectionIn
,
526 OUT UINT32
*PcrUpdateCounter
,
527 OUT TPML_PCR_SELECTION
*PcrSelectionOut
,
528 OUT TPML_DIGEST
*PcrValues
532 This command is used to set the desired PCR allocation of PCR and algorithms.
534 @param[in] AuthHandle TPM_RH_PLATFORM+{PP}
535 @param[in] AuthSession Auth Session context
536 @param[in] PcrAllocation The requested allocation
537 @param[out] AllocationSuccess YES if the allocation succeeded
538 @param[out] MaxPCR maximum number of PCR that may be in a bank
539 @param[out] SizeNeeded number of octets required to satisfy the request
540 @param[out] SizeAvailable Number of octets available. Computed before the allocation
542 @retval EFI_SUCCESS Operation completed successfully.
543 @retval EFI_DEVICE_ERROR The command was unsuccessful.
548 IN TPMI_RH_PLATFORM AuthHandle
,
549 IN TPMS_AUTH_COMMAND
*AuthSession
,
550 IN TPML_PCR_SELECTION
*PcrAllocation
,
551 OUT TPMI_YES_NO
*AllocationSuccess
,
553 OUT UINT32
*SizeNeeded
,
554 OUT UINT32
*SizeAvailable
560 @param[in] PlatformAuth platform auth value. NULL means no platform auth change.
561 @param[in] SupportedPCRBanks Supported PCR banks
562 @param[in] PCRBanks PCR banks
564 @retval EFI_SUCCESS Operation completed successfully.
568 Tpm2PcrAllocateBanks (
569 IN TPM2B_AUTH
*PlatformAuth
, OPTIONAL
570 IN UINT32 SupportedPCRBanks
,
575 This command returns various information regarding the TPM and its current state.
577 The capability parameter determines the category of data returned. The property parameter
578 selects the first value of the selected category to be returned. If there is no property
579 that corresponds to the value of property, the next higher value is returned, if it exists.
580 The moreData parameter will have a value of YES if there are more values of the requested
581 type that were not returned.
582 If no next capability exists, the TPM will return a zero-length list and moreData will have
586 To simplify this function, leave returned CapabilityData for caller to unpack since there are
587 many capability categories and only few categories will be used in firmware. It means the caller
588 need swap the byte order for the feilds in CapabilityData.
590 @param[in] Capability Group selection; determines the format of the response.
591 @param[in] Property Further definition of information.
592 @param[in] PropertyCount Number of properties of the indicated type to return.
593 @param[out] MoreData Flag to indicate if there are more values of this type.
594 @param[out] CapabilityData The capability data.
596 @retval EFI_SUCCESS Operation completed successfully.
597 @retval EFI_DEVICE_ERROR The command was unsuccessful.
602 IN TPM_CAP Capability
,
604 IN UINT32 PropertyCount
,
605 OUT TPMI_YES_NO
*MoreData
,
606 OUT TPMS_CAPABILITY_DATA
*CapabilityData
610 This command returns the information of TPM Family.
612 This function parse the value got from TPM2_GetCapability and return the Family.
614 @param[out] Family The Family of TPM. (a 4-octet character string)
616 @retval EFI_SUCCESS Operation completed successfully.
617 @retval EFI_DEVICE_ERROR The command was unsuccessful.
621 Tpm2GetCapabilityFamily (
626 This command returns the information of TPM manufacture ID.
628 This function parse the value got from TPM2_GetCapability and return the TPM manufacture ID.
630 @param[out] ManufactureId The manufacture ID of TPM.
632 @retval EFI_SUCCESS Operation completed successfully.
633 @retval EFI_DEVICE_ERROR The command was unsuccessful.
637 Tpm2GetCapabilityManufactureID (
638 OUT UINT32
*ManufactureId
642 This command returns the information of TPM FirmwareVersion.
644 This function parse the value got from TPM2_GetCapability and return the TPM FirmwareVersion.
646 @param[out] FirmwareVersion1 The FirmwareVersion1.
647 @param[out] FirmwareVersion2 The FirmwareVersion2.
649 @retval EFI_SUCCESS Operation completed successfully.
650 @retval EFI_DEVICE_ERROR The command was unsuccessful.
654 Tpm2GetCapabilityFirmwareVersion (
655 OUT UINT32
*FirmwareVersion1
,
656 OUT UINT32
*FirmwareVersion2
660 This command returns the information of the maximum value for commandSize and responseSize in a command.
662 This function parse the value got from TPM2_GetCapability and return the max command size and response size
664 @param[out] MaxCommandSize The maximum value for commandSize in a command.
665 @param[out] MaxResponseSize The maximum value for responseSize in a command.
667 @retval EFI_SUCCESS Operation completed successfully.
668 @retval EFI_DEVICE_ERROR The command was unsuccessful.
672 Tpm2GetCapabilityMaxCommandResponseSize (
673 OUT UINT32
*MaxCommandSize
,
674 OUT UINT32
*MaxResponseSize
678 This command returns Returns a list of TPMS_ALG_PROPERTIES. Each entry is an
679 algorithm ID and a set of properties of the algorithm.
681 This function parse the value got from TPM2_GetCapability and return the list.
683 @param[out] AlgList List of algorithm.
685 @retval EFI_SUCCESS Operation completed successfully.
686 @retval EFI_DEVICE_ERROR The command was unsuccessful.
690 Tpm2GetCapabilitySupportedAlg (
691 OUT TPML_ALG_PROPERTY
*AlgList
695 This command returns the information of TPM LockoutCounter.
697 This function parse the value got from TPM2_GetCapability and return the LockoutCounter.
699 @param[out] LockoutCounter The LockoutCounter of TPM.
701 @retval EFI_SUCCESS Operation completed successfully.
702 @retval EFI_DEVICE_ERROR The command was unsuccessful.
706 Tpm2GetCapabilityLockoutCounter (
707 OUT UINT32
*LockoutCounter
711 This command returns the information of TPM LockoutInterval.
713 This function parse the value got from TPM2_GetCapability and return the LockoutInterval.
715 @param[out] LockoutInterval The LockoutInterval of TPM.
717 @retval EFI_SUCCESS Operation completed successfully.
718 @retval EFI_DEVICE_ERROR The command was unsuccessful.
722 Tpm2GetCapabilityLockoutInterval (
723 OUT UINT32
*LockoutInterval
727 This command returns the information of TPM InputBufferSize.
729 This function parse the value got from TPM2_GetCapability and return the InputBufferSize.
731 @param[out] InputBufferSize The InputBufferSize of TPM.
732 the maximum size of a parameter (typically, a TPM2B_MAX_BUFFER)
734 @retval EFI_SUCCESS Operation completed successfully.
735 @retval EFI_DEVICE_ERROR The command was unsuccessful.
739 Tpm2GetCapabilityInputBufferSize (
740 OUT UINT32
*InputBufferSize
744 This command returns the information of TPM PCRs.
746 This function parse the value got from TPM2_GetCapability and return the PcrSelection.
748 @param[out] Pcrs The Pcr Selection
750 @retval EFI_SUCCESS Operation completed successfully.
751 @retval EFI_DEVICE_ERROR The command was unsuccessful.
755 Tpm2GetCapabilityPcrs (
756 OUT TPML_PCR_SELECTION
*Pcrs
760 This function will query the TPM to determine which hashing algorithms
761 are supported and which PCR banks are currently active.
763 @param[out] TpmHashAlgorithmBitmap A bitmask containing the algorithms supported by the TPM.
764 @param[out] ActivePcrBanks A bitmask containing the PCRs currently allocated.
766 @retval EFI_SUCCESS TPM was successfully queried and return values can be trusted.
767 @retval Others An error occurred, likely in communication with the TPM.
772 Tpm2GetCapabilitySupportedAndActivePcrs(
773 OUT UINT32
*TpmHashAlgorithmBitmap
,
774 OUT UINT32
*ActivePcrBanks
778 This command returns the information of TPM AlgorithmSet.
780 This function parse the value got from TPM2_GetCapability and return the AlgorithmSet.
782 @param[out] AlgorithmSet The AlgorithmSet of TPM.
784 @retval EFI_SUCCESS Operation completed successfully.
785 @retval EFI_DEVICE_ERROR The command was unsuccessful.
789 Tpm2GetCapabilityAlgorithmSet (
790 OUT UINT32
*AlgorithmSet
794 This command is used to check to see if specific combinations of algorithm parameters are supported.
796 @param[in] Parameters Algorithm parameters to be validated
798 @retval EFI_SUCCESS Operation completed successfully.
799 @retval EFI_DEVICE_ERROR Unexpected device behavior.
804 IN TPMT_PUBLIC_PARMS
*Parameters
808 This command allows the platform to change the set of algorithms that are used by the TPM.
809 The algorithmSet setting is a vendor-dependent value.
811 @param[in] AuthHandle TPM_RH_PLATFORM
812 @param[in] AuthSession Auth Session context
813 @param[in] AlgorithmSet A TPM vendor-dependent value indicating the
814 algorithm set selection
816 @retval EFI_SUCCESS Operation completed successfully.
817 @retval EFI_DEVICE_ERROR Unexpected device behavior.
821 Tpm2SetAlgorithmSet (
822 IN TPMI_RH_PLATFORM AuthHandle
,
823 IN TPMS_AUTH_COMMAND
*AuthSession
,
824 IN UINT32 AlgorithmSet
828 This command is used to start an authorization session using alternative methods of
829 establishing the session key (sessionKey) that is used for authorization and encrypting value.
831 @param[in] TpmKey Handle of a loaded decrypt key used to encrypt salt.
832 @param[in] Bind Entity providing the authValue.
833 @param[in] NonceCaller Initial nonceCaller, sets nonce size for the session.
834 @param[in] Salt Value encrypted according to the type of tpmKey.
835 @param[in] SessionType Indicates the type of the session.
836 @param[in] Symmetric The algorithm and key size for parameter encryption.
837 @param[in] AuthHash Hash algorithm to use for the session.
838 @param[out] SessionHandle Handle for the newly created session.
839 @param[out] NonceTPM The initial nonce from the TPM, used in the computation of the sessionKey.
841 @retval EFI_SUCCESS Operation completed successfully.
842 @retval EFI_DEVICE_ERROR The command was unsuccessful.
846 Tpm2StartAuthSession (
847 IN TPMI_DH_OBJECT TpmKey
,
848 IN TPMI_DH_ENTITY Bind
,
849 IN TPM2B_NONCE
*NonceCaller
,
850 IN TPM2B_ENCRYPTED_SECRET
*Salt
,
851 IN TPM_SE SessionType
,
852 IN TPMT_SYM_DEF
*Symmetric
,
853 IN TPMI_ALG_HASH AuthHash
,
854 OUT TPMI_SH_AUTH_SESSION
*SessionHandle
,
855 OUT TPM2B_NONCE
*NonceTPM
859 This command causes all context associated with a loaded object or session to be removed from TPM memory.
861 @param[in] FlushHandle The handle of the item to flush.
863 @retval EFI_SUCCESS Operation completed successfully.
864 @retval EFI_DEVICE_ERROR The command was unsuccessful.
869 IN TPMI_DH_CONTEXT FlushHandle
873 This command includes a secret-based authorization to a policy.
874 The caller proves knowledge of the secret value using an authorization
875 session using the authValue associated with authHandle.
877 @param[in] AuthHandle Handle for an entity providing the authorization
878 @param[in] PolicySession Handle for the policy session being extended.
879 @param[in] AuthSession Auth Session context
880 @param[in] NonceTPM The policy nonce for the session.
881 @param[in] CpHashA Digest of the command parameters to which this authorization is limited.
882 @param[in] PolicyRef A reference to a policy relating to the authorization.
883 @param[in] Expiration Time when authorization will expire, measured in seconds from the time that nonceTPM was generated.
884 @param[out] Timeout Time value used to indicate to the TPM when the ticket expires.
885 @param[out] PolicyTicket A ticket that includes a value indicating when the authorization expires.
887 @retval EFI_SUCCESS Operation completed successfully.
888 @retval EFI_DEVICE_ERROR The command was unsuccessful.
893 IN TPMI_DH_ENTITY AuthHandle
,
894 IN TPMI_SH_POLICY PolicySession
,
895 IN TPMS_AUTH_COMMAND
*AuthSession
, OPTIONAL
896 IN TPM2B_NONCE
*NonceTPM
,
897 IN TPM2B_DIGEST
*CpHashA
,
898 IN TPM2B_NONCE
*PolicyRef
,
900 OUT TPM2B_TIMEOUT
*Timeout
,
901 OUT TPMT_TK_AUTH
*PolicyTicket
905 This command allows options in authorizations without requiring that the TPM evaluate all of the options.
906 If a policy may be satisfied by different sets of conditions, the TPM need only evaluate one set that
907 satisfies the policy. This command will indicate that one of the required sets of conditions has been
910 @param[in] PolicySession Handle for the policy session being extended.
911 @param[in] HashList the list of hashes to check for a match.
913 @retval EFI_SUCCESS Operation completed successfully.
914 @retval EFI_DEVICE_ERROR The command was unsuccessful.
919 IN TPMI_SH_POLICY PolicySession
,
920 IN TPML_DIGEST
*HashList
924 This command indicates that the authorization will be limited to a specific command code.
926 @param[in] PolicySession Handle for the policy session being extended.
927 @param[in] Code The allowed commandCode.
929 @retval EFI_SUCCESS Operation completed successfully.
930 @retval EFI_DEVICE_ERROR The command was unsuccessful.
934 Tpm2PolicyCommandCode (
935 IN TPMI_SH_POLICY PolicySession
,
940 This command returns the current policyDigest of the session. This command allows the TPM
941 to be used to perform the actions required to precompute the authPolicy for an object.
943 @param[in] PolicySession Handle for the policy session.
944 @param[out] PolicyHash the current value of the policyHash of policySession.
946 @retval EFI_SUCCESS Operation completed successfully.
947 @retval EFI_DEVICE_ERROR The command was unsuccessful.
951 Tpm2PolicyGetDigest (
952 IN TPMI_SH_POLICY PolicySession
,
953 OUT TPM2B_DIGEST
*PolicyHash
957 This command allows access to the public area of a loaded object.
959 @param[in] ObjectHandle TPM handle of an object
960 @param[out] OutPublic Structure containing the public area of an object
961 @param[out] Name Name of the object
962 @param[out] QualifiedName The Qualified Name of the object
964 @retval EFI_SUCCESS Operation completed successfully.
965 @retval EFI_DEVICE_ERROR Unexpected device behavior.
970 IN TPMI_DH_OBJECT ObjectHandle
,
971 OUT TPM2B_PUBLIC
*OutPublic
,
972 OUT TPM2B_NAME
*Name
,
973 OUT TPM2B_NAME
*QualifiedName
981 Copy AuthSessionIn to TPM2 command buffer.
983 @param [in] AuthSessionIn Input AuthSession data
984 @param [out] AuthSessionOut Output AuthSession data in TPM2 command buffer
986 @return AuthSession size
990 CopyAuthSessionCommand (
991 IN TPMS_AUTH_COMMAND
*AuthSessionIn
, OPTIONAL
992 OUT UINT8
*AuthSessionOut
996 Copy AuthSessionIn from TPM2 response buffer.
998 @param [in] AuthSessionIn Input AuthSession data in TPM2 response buffer
999 @param [out] AuthSessionOut Output AuthSession data
1001 @return AuthSession size
1005 CopyAuthSessionResponse (
1006 IN UINT8
*AuthSessionIn
,
1007 OUT TPMS_AUTH_RESPONSE
*AuthSessionOut OPTIONAL
1011 Return size of digest.
1013 @param[in] HashAlgo Hash algorithm
1015 @return size of digest
1019 GetHashSizeFromAlgo (
1020 IN TPMI_ALG_HASH HashAlgo
1024 Get hash mask from algorithm.
1026 @param[in] HashAlgo Hash algorithm
1032 GetHashMaskFromAlgo (
1033 IN TPMI_ALG_HASH HashAlgo
1037 Return if hash alg is supported in HashAlgorithmMask.
1039 @param HashAlg Hash algorithm to be checked.
1040 @param HashAlgorithmMask Bitfield of allowed hash algorithms.
1042 @retval TRUE Hash algorithm is supported.
1043 @retval FALSE Hash algorithm is not supported.
1047 IsHashAlgSupportedInHashAlgorithmMask(
1048 IN TPMI_ALG_HASH HashAlg
,
1049 IN UINT32 HashAlgorithmMask
1053 Copy TPML_DIGEST_VALUES into a buffer
1055 @param[in,out] Buffer Buffer to hold copied TPML_DIGEST_VALUES compact binary.
1056 @param[in] DigestList TPML_DIGEST_VALUES to be copied.
1057 @param[in] HashAlgorithmMask HASH bits corresponding to the desired digests to copy.
1059 @return The end of buffer to hold TPML_DIGEST_VALUES.
1063 CopyDigestListToBuffer(
1064 IN OUT VOID
*Buffer
,
1065 IN TPML_DIGEST_VALUES
*DigestList
,
1066 IN UINT32 HashAlgorithmMask
1070 Get TPML_DIGEST_VALUES data size.
1072 @param[in] DigestList TPML_DIGEST_VALUES data.
1074 @return TPML_DIGEST_VALUES data size.
1079 IN TPML_DIGEST_VALUES
*DigestList
1083 This function get digest from digest list.
1085 @param[in] HashAlg Digest algorithm
1086 @param[in] DigestList Digest list
1087 @param[out] Digest Digest
1089 @retval EFI_SUCCESS Digest is found and returned.
1090 @retval EFI_NOT_FOUND Digest is not found.
1094 GetDigestFromDigestList(
1095 IN TPMI_ALG_HASH HashAlg
,
1096 IN TPML_DIGEST_VALUES
*DigestList
,