SecurityPkg/Include/Library/Tpm2CommandLib.h

   1 /** @file
   2   This library is used by other modules to send TPM2 command.
   3
   4 Copyright (c) 2013 - 2016, Intel Corporation. All rights reserved. <BR>
   5 This program and the accompanying materials
   6 are licensed and made available under the terms and conditions of the BSD License
   7 which accompanies this distribution.  The full text of the license may be found at
   8 http://opensource.org/licenses/bsd-license.php
   9
  10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  12
  13 **/
  14
  15 #ifndef _TPM2_COMMAND_LIB_H_
  16 #define _TPM2_COMMAND_LIB_H_
  17
  18 #include <IndustryStandard/Tpm20.h>
  19
  20 /**
  21   This command starts a hash or an Event sequence.
  22   If hashAlg is an implemented hash, then a hash sequence is started.
  23   If hashAlg is TPM_ALG_NULL, then an Event sequence is started.
  24
  25   @param[in]  HashAlg           The hash algorithm to use for the hash sequence
  26                                 An Event sequence starts if this is TPM_ALG_NULL.
  27   @param[out] SequenceHandle    A handle to reference the sequence
  28
  29   @retval EFI_SUCCESS      Operation completed successfully.
  30   @retval EFI_DEVICE_ERROR Unexpected device behavior.
  31 **/
  32 EFI_STATUS
  33 EFIAPI
  34 Tpm2HashSequenceStart (
  35   IN TPMI_ALG_HASH   HashAlg,
  36   OUT TPMI_DH_OBJECT *SequenceHandle
  37   );
  38
  39 /**
  40   This command is used to add data to a hash or HMAC sequence.
  41   The amount of data in buffer may be any size up to the limits of the TPM.
  42   NOTE: In all TPM, a buffer size of 1,024 octets is allowed.
  43
  44   @param[in] SequenceHandle    Handle for the sequence object
  45   @param[in] Buffer            Data to be added to hash
  46
  47   @retval EFI_SUCCESS      Operation completed successfully.
  48   @retval EFI_DEVICE_ERROR Unexpected device behavior.
  49 **/
  50 EFI_STATUS
  51 EFIAPI
  52 Tpm2SequenceUpdate (
  53   IN TPMI_DH_OBJECT   SequenceHandle,
  54   IN TPM2B_MAX_BUFFER *Buffer
  55   );
  56
  57 /**
  58   This command adds the last part of data, if any, to an Event sequence and returns the result in a digest list.
  59   If pcrHandle references a PCR and not TPM_RH_NULL, then the returned digest list is processed in
  60   the same manner as the digest list input parameter to TPM2_PCR_Extend() with the pcrHandle in each
  61   bank extended with the associated digest value.
  62
  63   @param[in]  PcrHandle         PCR to be extended with the Event data
  64   @param[in]  SequenceHandle    Authorization for the sequence
  65   @param[in]  Buffer            Data to be added to the Event
  66   @param[out] Results           List of digests computed for the PCR
  67
  68   @retval EFI_SUCCESS      Operation completed successfully.
  69   @retval EFI_DEVICE_ERROR Unexpected device behavior.
  70 **/
  71 EFI_STATUS
  72 EFIAPI
  73 Tpm2EventSequenceComplete (
  74   IN TPMI_DH_PCR         PcrHandle,
  75   IN TPMI_DH_OBJECT      SequenceHandle,
  76   IN TPM2B_MAX_BUFFER    *Buffer,
  77   OUT TPML_DIGEST_VALUES *Results
  78   );
  79
  80 /**
  81   This command adds the last part of data, if any, to a hash/HMAC sequence and returns the result.
  82
  83   @param[in]  SequenceHandle    Authorization for the sequence
  84   @param[in]  Buffer            Data to be added to the hash/HMAC
  85   @param[out] Result            The returned HMAC or digest in a sized buffer
  86
  87   @retval EFI_SUCCESS      Operation completed successfully.
  88   @retval EFI_DEVICE_ERROR Unexpected device behavior.
  89 **/
  90 EFI_STATUS
  91 EFIAPI
  92 Tpm2SequenceComplete (
  93   IN TPMI_DH_OBJECT      SequenceHandle,
  94   IN TPM2B_MAX_BUFFER    *Buffer,
  95   OUT TPM2B_DIGEST       *Result
  96   );
  97
  98 /**
  99   Send Startup command to TPM2.
 100
 101   @param[in] StartupType           TPM_SU_CLEAR or TPM_SU_STATE
 102
 103   @retval EFI_SUCCESS      Operation completed successfully.
 104   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 105 **/
 106 EFI_STATUS
 107 EFIAPI
 108 Tpm2Startup (
 109   IN      TPM_SU             StartupType
 110   );
 111
 112 /**
 113   Send Shutdown command to TPM2.
 114
 115   @param[in] ShutdownType           TPM_SU_CLEAR or TPM_SU_STATE.
 116
 117   @retval EFI_SUCCESS      Operation completed successfully.
 118   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 119 **/
 120 EFI_STATUS
 121 EFIAPI
 122 Tpm2Shutdown (
 123   IN      TPM_SU             ShutdownType
 124   );
 125
 126 /**
 127   This command causes the TPM to perform a test of its capabilities.
 128   If the fullTest is YES, the TPM will test all functions.
 129   If fullTest = NO, the TPM will only test those functions that have not previously been tested.
 130
 131   @param[in] FullTest    YES if full test to be performed
 132                          NO if only test of untested functions required
 133
 134   @retval EFI_SUCCESS      Operation completed successfully.
 135   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 136 **/
 137 EFI_STATUS
 138 EFIAPI
 139 Tpm2SelfTest (
 140   IN TPMI_YES_NO          FullTest
 141   );
 142
 143 /**
 144   This command allows setting of the authorization policy for the platform hierarchy (platformPolicy), the
 145   storage hierarchy (ownerPolicy), and and the endorsement hierarchy (endorsementPolicy).
 146
 147   @param[in]  AuthHandle            TPM_RH_ENDORSEMENT, TPM_RH_OWNER or TPM_RH_PLATFORM+{PP} parameters to be validated
 148   @param[in]  AuthSession           Auth Session context
 149   @param[in]  AuthPolicy            An authorization policy hash
 150   @param[in]  HashAlg               The hash algorithm to use for the policy
 151
 152   @retval EFI_SUCCESS      Operation completed successfully.
 153   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 154 **/
 155 EFI_STATUS
 156 EFIAPI
 157 Tpm2SetPrimaryPolicy (
 158   IN  TPMI_RH_HIERARCHY_AUTH    AuthHandle,
 159   IN  TPMS_AUTH_COMMAND         *AuthSession,
 160   IN  TPM2B_DIGEST              *AuthPolicy,
 161   IN  TPMI_ALG_HASH             HashAlg
 162   );
 163
 164 /**
 165   This command removes all TPM context associated with a specific Owner.
 166
 167   @param[in] AuthHandle        TPM_RH_LOCKOUT or TPM_RH_PLATFORM+{PP}
 168   @param[in] AuthSession       Auth Session context
 169
 170   @retval EFI_SUCCESS      Operation completed successfully.
 171   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 172 **/
 173 EFI_STATUS
 174 EFIAPI
 175 Tpm2Clear (
 176   IN TPMI_RH_CLEAR             AuthHandle,
 177   IN TPMS_AUTH_COMMAND         *AuthSession OPTIONAL
 178   );
 179
 180 /**
 181   Disables and enables the execution of TPM2_Clear().
 182
 183   @param[in] AuthHandle        TPM_RH_LOCKOUT or TPM_RH_PLATFORM+{PP}
 184   @param[in] AuthSession       Auth Session context
 185   @param[in] Disable           YES if the disableOwnerClear flag is to be SET,
 186                                NO if the flag is to be CLEAR.
 187
 188   @retval EFI_SUCCESS      Operation completed successfully.
 189   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 190 **/
 191 EFI_STATUS
 192 EFIAPI
 193 Tpm2ClearControl (
 194   IN TPMI_RH_CLEAR             AuthHandle,
 195   IN TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
 196   IN TPMI_YES_NO               Disable
 197   );
 198
 199 /**
 200   This command allows the authorization secret for a hierarchy or lockout to be changed using the current
 201   authorization value as the command authorization.
 202
 203   @param[in] AuthHandle        TPM_RH_LOCKOUT, TPM_RH_ENDORSEMENT, TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}
 204   @param[in] AuthSession       Auth Session context
 205   @param[in] NewAuth           New authorization secret
 206
 207   @retval EFI_SUCCESS      Operation completed successfully.
 208   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 209 **/
 210 EFI_STATUS
 211 EFIAPI
 212 Tpm2HierarchyChangeAuth (
 213   IN TPMI_RH_HIERARCHY_AUTH    AuthHandle,
 214   IN TPMS_AUTH_COMMAND         *AuthSession,
 215   IN TPM2B_AUTH                *NewAuth
 216   );
 217
 218 /**
 219   This replaces the current EPS with a value from the RNG and sets the Endorsement hierarchy controls to
 220   their default initialization values.
 221
 222   @param[in] AuthHandle        TPM_RH_PLATFORM+{PP}
 223   @param[in] AuthSession       Auth Session context
 224
 225   @retval EFI_SUCCESS      Operation completed successfully.
 226   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 227 **/
 228 EFI_STATUS
 229 EFIAPI
 230 Tpm2ChangeEPS (
 231   IN TPMI_RH_PLATFORM          AuthHandle,
 232   IN TPMS_AUTH_COMMAND         *AuthSession
 233   );
 234
 235 /**
 236   This replaces the current PPS with a value from the RNG and sets platformPolicy to the default
 237   initialization value (the Empty Buffer).
 238
 239   @param[in] AuthHandle        TPM_RH_PLATFORM+{PP}
 240   @param[in] AuthSession       Auth Session context
 241
 242   @retval EFI_SUCCESS      Operation completed successfully.
 243   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 244 **/
 245 EFI_STATUS
 246 EFIAPI
 247 Tpm2ChangePPS (
 248   IN TPMI_RH_PLATFORM          AuthHandle,
 249   IN TPMS_AUTH_COMMAND         *AuthSession
 250   );
 251
 252 /**
 253   This command enables and disables use of a hierarchy.
 254
 255   @param[in] AuthHandle        TPM_RH_ENDORSEMENT, TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}
 256   @param[in] AuthSession       Auth Session context
 257   @param[in] Hierarchy         Hierarchy of the enable being modified
 258   @param[in] State             YES if the enable should be SET,
 259                                NO if the enable should be CLEAR
 260
 261   @retval EFI_SUCCESS      Operation completed successfully.
 262   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 263 **/
 264 EFI_STATUS
 265 EFIAPI
 266 Tpm2HierarchyControl (
 267   IN TPMI_RH_HIERARCHY         AuthHandle,
 268   IN TPMS_AUTH_COMMAND         *AuthSession,
 269   IN TPMI_RH_HIERARCHY         Hierarchy,
 270   IN TPMI_YES_NO               State
 271   );
 272
 273 /**
 274   This command cancels the effect of a TPM lockout due to a number of successive authorization failures.
 275   If this command is properly authorized, the lockout counter is set to zero.
 276
 277   @param[in]  LockHandle            LockHandle
 278   @param[in]  AuthSession           Auth Session context
 279
 280   @retval EFI_SUCCESS      Operation completed successfully.
 281   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 282 **/
 283 EFI_STATUS
 284 EFIAPI
 285 Tpm2DictionaryAttackLockReset (
 286   IN  TPMI_RH_LOCKOUT           LockHandle,
 287   IN  TPMS_AUTH_COMMAND         *AuthSession
 288   );
 289
 290 /**
 291   This command cancels the effect of a TPM lockout due to a number of successive authorization failures.
 292   If this command is properly authorized, the lockout counter is set to zero.
 293
 294   @param[in]  LockHandle            LockHandle
 295   @param[in]  AuthSession           Auth Session context
 296   @param[in]  NewMaxTries           Count of authorization failures before the lockout is imposed
 297   @param[in]  NewRecoveryTime       Time in seconds before the authorization failure count is automatically decremented
 298   @param[in]  LockoutRecovery       Time in seconds after a lockoutAuth failure before use of lockoutAuth is allowed
 299
 300   @retval EFI_SUCCESS      Operation completed successfully.
 301   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 302 **/
 303 EFI_STATUS
 304 EFIAPI
 305 Tpm2DictionaryAttackParameters (
 306   IN  TPMI_RH_LOCKOUT           LockHandle,
 307   IN  TPMS_AUTH_COMMAND         *AuthSession,
 308   IN  UINT32                    NewMaxTries,
 309   IN  UINT32                    NewRecoveryTime,
 310   IN  UINT32                    LockoutRecovery
 311   );
 312
 313 /**
 314   This command is used to read the public area and Name of an NV Index.
 315
 316   @param[in]  NvIndex            The NV Index.
 317   @param[out] NvPublic           The public area of the index.
 318   @param[out] NvName             The Name of the nvIndex.
 319
 320   @retval EFI_SUCCESS            Operation completed successfully.
 321   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 322 **/
 323 EFI_STATUS
 324 EFIAPI
 325 Tpm2NvReadPublic (
 326   IN      TPMI_RH_NV_INDEX          NvIndex,
 327   OUT     TPM2B_NV_PUBLIC           *NvPublic,
 328   OUT     TPM2B_NAME                *NvName
 329   );
 330
 331 /**
 332   This command defines the attributes of an NV Index and causes the TPM to
 333   reserve space to hold the data associated with the index.
 334   If a definition already exists at the index, the TPM will return TPM_RC_NV_DEFINED.
 335
 336   @param[in]  AuthHandle         TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}.
 337   @param[in]  AuthSession        Auth Session context
 338   @param[in]  Auth               The authorization data.
 339   @param[in]  NvPublic           The public area of the index.
 340
 341   @retval EFI_SUCCESS            Operation completed successfully.
 342   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 343   @retval EFI_ALREADY_STARTED    The command was returned successfully, but NvIndex is already defined.
 344 **/
 345 EFI_STATUS
 346 EFIAPI
 347 Tpm2NvDefineSpace (
 348   IN      TPMI_RH_PROVISION         AuthHandle,
 349   IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
 350   IN      TPM2B_AUTH                *Auth,
 351   IN      TPM2B_NV_PUBLIC           *NvPublic
 352   );
 353
 354 /**
 355   This command removes an index from the TPM.
 356
 357   @param[in]  AuthHandle         TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}.
 358   @param[in]  NvIndex            The NV Index.
 359   @param[in]  AuthSession        Auth Session context
 360
 361   @retval EFI_SUCCESS            Operation completed successfully.
 362   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 363   @retval EFI_NOT_FOUND          The command was returned successfully, but NvIndex is not found.
 364 **/
 365 EFI_STATUS
 366 EFIAPI
 367 Tpm2NvUndefineSpace (
 368   IN      TPMI_RH_PROVISION         AuthHandle,
 369   IN      TPMI_RH_NV_INDEX          NvIndex,
 370   IN      TPMS_AUTH_COMMAND         *AuthSession OPTIONAL
 371   );
 372
 373 /**
 374   This command reads a value from an area in NV memory previously defined by TPM2_NV_DefineSpace().
 375
 376   @param[in]     AuthHandle         the handle indicating the source of the authorization value.
 377   @param[in]     NvIndex            The index to be read.
 378   @param[in]     AuthSession        Auth Session context
 379   @param[in]     Size               Number of bytes to read.
 380   @param[in]     Offset             Byte offset into the area.
 381   @param[in,out] OutData            The data read.
 382
 383   @retval EFI_SUCCESS            Operation completed successfully.
 384   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 385   @retval EFI_NOT_FOUND          The command was returned successfully, but NvIndex is not found.
 386 **/
 387 EFI_STATUS
 388 EFIAPI
 389 Tpm2NvRead (
 390   IN      TPMI_RH_NV_AUTH           AuthHandle,
 391   IN      TPMI_RH_NV_INDEX          NvIndex,
 392   IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
 393   IN      UINT16                    Size,
 394   IN      UINT16                    Offset,
 395   IN OUT  TPM2B_MAX_BUFFER          *OutData
 396   );
 397
 398 /**
 399   This command writes a value to an area in NV memory that was previously defined by TPM2_NV_DefineSpace().
 400
 401   @param[in]  AuthHandle         the handle indicating the source of the authorization value.
 402   @param[in]  NvIndex            The NV Index of the area to write.
 403   @param[in]  AuthSession        Auth Session context
 404   @param[in]  InData             The data to write.
 405   @param[in]  Offset             The offset into the NV Area.
 406
 407   @retval EFI_SUCCESS            Operation completed successfully.
 408   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 409   @retval EFI_NOT_FOUND          The command was returned successfully, but NvIndex is not found.
 410 **/
 411 EFI_STATUS
 412 EFIAPI
 413 Tpm2NvWrite (
 414   IN      TPMI_RH_NV_AUTH           AuthHandle,
 415   IN      TPMI_RH_NV_INDEX          NvIndex,
 416   IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
 417   IN      TPM2B_MAX_BUFFER          *InData,
 418   IN      UINT16                    Offset
 419   );
 420
 421 /**
 422   This command may be used to prevent further reads of the Index until the next TPM2_Startup (TPM_SU_CLEAR).
 423
 424   @param[in]  AuthHandle         the handle indicating the source of the authorization value.
 425   @param[in]  NvIndex            The NV Index of the area to lock.
 426   @param[in]  AuthSession        Auth Session context
 427
 428   @retval EFI_SUCCESS            Operation completed successfully.
 429   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 430   @retval EFI_NOT_FOUND          The command was returned successfully, but NvIndex is not found.
 431 **/
 432 EFI_STATUS
 433 EFIAPI
 434 Tpm2NvReadLock (
 435   IN      TPMI_RH_NV_AUTH           AuthHandle,
 436   IN      TPMI_RH_NV_INDEX          NvIndex,
 437   IN      TPMS_AUTH_COMMAND         *AuthSession OPTIONAL
 438   );
 439
 440 /**
 441   This command may be used to inhibit further writes of the Index.
 442
 443   @param[in]  AuthHandle         the handle indicating the source of the authorization value.
 444   @param[in]  NvIndex            The NV Index of the area to lock.
 445   @param[in]  AuthSession        Auth Session context
 446
 447   @retval EFI_SUCCESS            Operation completed successfully.
 448   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 449   @retval EFI_NOT_FOUND          The command was returned successfully, but NvIndex is not found.
 450 **/
 451 EFI_STATUS
 452 EFIAPI
 453 Tpm2NvWriteLock (
 454   IN      TPMI_RH_NV_AUTH           AuthHandle,
 455   IN      TPMI_RH_NV_INDEX          NvIndex,
 456   IN      TPMS_AUTH_COMMAND         *AuthSession OPTIONAL
 457   );
 458
 459 /**
 460   The command will SET TPMA_NV_WRITELOCKED for all indexes that have their TPMA_NV_GLOBALLOCK attribute SET.
 461
 462   @param[in]  AuthHandle         TPM_RH_OWNER or TPM_RH_PLATFORM+{PP}.
 463   @param[in]  AuthSession        Auth Session context
 464
 465   @retval EFI_SUCCESS            Operation completed successfully.
 466   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 467   @retval EFI_NOT_FOUND          The command was returned successfully, but NvIndex is not found.
 468 **/
 469 EFI_STATUS
 470 EFIAPI
 471 Tpm2NvGlobalWriteLock (
 472   IN      TPMI_RH_PROVISION         AuthHandle,
 473   IN      TPMS_AUTH_COMMAND         *AuthSession OPTIONAL
 474   );
 475
 476 /**
 477   This command is used to cause an update to the indicated PCR.
 478   The digests parameter contains one or more tagged digest value identified by an algorithm ID.
 479   For each digest, the PCR associated with pcrHandle is Extended into the bank identified by the tag (hashAlg).
 480
 481   @param[in] PcrHandle   Handle of the PCR
 482   @param[in] Digests     List of tagged digest values to be extended
 483
 484   @retval EFI_SUCCESS      Operation completed successfully.
 485   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 486 **/
 487 EFI_STATUS
 488 EFIAPI
 489 Tpm2PcrExtend (
 490   IN      TPMI_DH_PCR               PcrHandle,
 491   IN      TPML_DIGEST_VALUES        *Digests
 492   );
 493
 494 /**
 495   This command is used to cause an update to the indicated PCR.
 496   The data in eventData is hashed using the hash algorithm associated with each bank in which the
 497   indicated PCR has been allocated. After the data is hashed, the digests list is returned. If the pcrHandle
 498   references an implemented PCR and not TPM_ALG_NULL, digests list is processed as in
 499   TPM2_PCR_Extend().
 500   A TPM shall support an Event.size of zero through 1,024 inclusive.
 501
 502   @param[in]  PcrHandle   Handle of the PCR
 503   @param[in]  EventData   Event data in sized buffer
 504   @param[out] Digests     List of digest
 505
 506   @retval EFI_SUCCESS      Operation completed successfully.
 507   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 508 **/
 509 EFI_STATUS
 510 EFIAPI
 511 Tpm2PcrEvent (
 512   IN      TPMI_DH_PCR               PcrHandle,
 513   IN      TPM2B_EVENT               *EventData,
 514      OUT  TPML_DIGEST_VALUES        *Digests
 515   );
 516
 517 /**
 518   This command returns the values of all PCR specified in pcrSelect.
 519
 520   @param[in]  PcrSelectionIn     The selection of PCR to read.
 521   @param[out] PcrUpdateCounter   The current value of the PCR update counter.
 522   @param[out] PcrSelectionOut    The PCR in the returned list.
 523   @param[out] PcrValues          The contents of the PCR indicated in pcrSelect.
 524
 525   @retval EFI_SUCCESS            Operation completed successfully.
 526   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 527 **/
 528 EFI_STATUS
 529 EFIAPI
 530 Tpm2PcrRead (
 531   IN      TPML_PCR_SELECTION        *PcrSelectionIn,
 532      OUT  UINT32                    *PcrUpdateCounter,
 533      OUT  TPML_PCR_SELECTION        *PcrSelectionOut,
 534      OUT  TPML_DIGEST               *PcrValues
 535   );
 536
 537 /**
 538   This command is used to set the desired PCR allocation of PCR and algorithms.
 539
 540   @param[in]  AuthHandle         TPM_RH_PLATFORM+{PP}
 541   @param[in]  AuthSession        Auth Session context
 542   @param[in]  PcrAllocation      The requested allocation
 543   @param[out] AllocationSuccess  YES if the allocation succeeded
 544   @param[out] MaxPCR             maximum number of PCR that may be in a bank
 545   @param[out] SizeNeeded         number of octets required to satisfy the request
 546   @param[out] SizeAvailable      Number of octets available. Computed before the allocation
 547
 548   @retval EFI_SUCCESS            Operation completed successfully.
 549   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 550 **/
 551 EFI_STATUS
 552 EFIAPI
 553 Tpm2PcrAllocate (
 554   IN  TPMI_RH_PLATFORM          AuthHandle,
 555   IN  TPMS_AUTH_COMMAND         *AuthSession,
 556   IN  TPML_PCR_SELECTION        *PcrAllocation,
 557   OUT TPMI_YES_NO               *AllocationSuccess,
 558   OUT UINT32                    *MaxPCR,
 559   OUT UINT32                    *SizeNeeded,
 560   OUT UINT32                    *SizeAvailable
 561   );
 562
 563 /**
 564   Alloc PCR data.
 565
 566   @param[in]  PlatformAuth      platform auth value. NULL means no platform auth change.
 567   @param[in]  SupportedPCRBanks Supported PCR banks
 568   @param[in]  PCRBanks          PCR banks
 569
 570   @retval EFI_SUCCESS Operation completed successfully.
 571 **/
 572 EFI_STATUS
 573 EFIAPI
 574 Tpm2PcrAllocateBanks (
 575   IN TPM2B_AUTH                *PlatformAuth,  OPTIONAL
 576   IN UINT32                    SupportedPCRBanks,
 577   IN UINT32                    PCRBanks
 578   );
 579
 580 /**
 581   This command returns various information regarding the TPM and its current state.
 582
 583   The capability parameter determines the category of data returned. The property parameter
 584   selects the first value of the selected category to be returned. If there is no property
 585   that corresponds to the value of property, the next higher value is returned, if it exists.
 586   The moreData parameter will have a value of YES if there are more values of the requested
 587   type that were not returned.
 588   If no next capability exists, the TPM will return a zero-length list and moreData will have
 589   a value of NO.
 590
 591   NOTE:
 592   To simplify this function, leave returned CapabilityData for caller to unpack since there are
 593   many capability categories and only few categories will be used in firmware. It means the caller
 594   need swap the byte order for the feilds in CapabilityData.
 595
 596   @param[in]  Capability         Group selection; determines the format of the response.
 597   @param[in]  Property           Further definition of information.
 598   @param[in]  PropertyCount      Number of properties of the indicated type to return.
 599   @param[out] MoreData           Flag to indicate if there are more values of this type.
 600   @param[out] CapabilityData     The capability data.
 601
 602   @retval EFI_SUCCESS            Operation completed successfully.
 603   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 604 **/
 605 EFI_STATUS
 606 EFIAPI
 607 Tpm2GetCapability (
 608   IN      TPM_CAP                   Capability,
 609   IN      UINT32                    Property,
 610   IN      UINT32                    PropertyCount,
 611   OUT     TPMI_YES_NO               *MoreData,
 612   OUT     TPMS_CAPABILITY_DATA      *CapabilityData
 613   );
 614
 615 /**
 616   This command returns the information of TPM Family.
 617
 618   This function parse the value got from TPM2_GetCapability and return the Family.
 619
 620   @param[out] Family             The Family of TPM. (a 4-octet character string)
 621
 622   @retval EFI_SUCCESS            Operation completed successfully.
 623   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 624 **/
 625 EFI_STATUS
 626 EFIAPI
 627 Tpm2GetCapabilityFamily (
 628   OUT     CHAR8                     *Family
 629   );
 630
 631 /**
 632   This command returns the information of TPM manufacture ID.
 633
 634   This function parse the value got from TPM2_GetCapability and return the TPM manufacture ID.
 635
 636   @param[out] ManufactureId      The manufacture ID of TPM.
 637
 638   @retval EFI_SUCCESS            Operation completed successfully.
 639   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 640 **/
 641 EFI_STATUS
 642 EFIAPI
 643 Tpm2GetCapabilityManufactureID (
 644   OUT     UINT32                    *ManufactureId
 645   );
 646
 647 /**
 648   This command returns the information of TPM FirmwareVersion.
 649
 650   This function parse the value got from TPM2_GetCapability and return the TPM FirmwareVersion.
 651
 652   @param[out] FirmwareVersion1   The FirmwareVersion1.
 653   @param[out] FirmwareVersion2   The FirmwareVersion2.
 654
 655   @retval EFI_SUCCESS            Operation completed successfully.
 656   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 657 **/
 658 EFI_STATUS
 659 EFIAPI
 660 Tpm2GetCapabilityFirmwareVersion (
 661   OUT     UINT32                    *FirmwareVersion1,
 662   OUT     UINT32                    *FirmwareVersion2
 663   );
 664
 665 /**
 666   This command returns the information of the maximum value for commandSize and responseSize in a command.
 667
 668   This function parse the value got from TPM2_GetCapability and return the max command size and response size
 669
 670   @param[out] MaxCommandSize     The maximum value for commandSize in a command.
 671   @param[out] MaxResponseSize    The maximum value for responseSize in a command.
 672
 673   @retval EFI_SUCCESS            Operation completed successfully.
 674   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 675 **/
 676 EFI_STATUS
 677 EFIAPI
 678 Tpm2GetCapabilityMaxCommandResponseSize (
 679   OUT UINT32                    *MaxCommandSize,
 680   OUT UINT32                    *MaxResponseSize
 681   );
 682
 683 /**
 684   This command returns Returns a list of TPMS_ALG_PROPERTIES. Each entry is an
 685   algorithm ID and a set of properties of the algorithm.
 686
 687   This function parse the value got from TPM2_GetCapability and return the list.
 688
 689   @param[out] AlgList      List of algorithm.
 690
 691   @retval EFI_SUCCESS            Operation completed successfully.
 692   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 693 **/
 694 EFI_STATUS
 695 EFIAPI
 696 Tpm2GetCapabilitySupportedAlg (
 697   OUT TPML_ALG_PROPERTY      *AlgList
 698   );
 699
 700 /**
 701   This command returns the information of TPM LockoutCounter.
 702
 703   This function parse the value got from TPM2_GetCapability and return the LockoutCounter.
 704
 705   @param[out] LockoutCounter     The LockoutCounter of TPM.
 706
 707   @retval EFI_SUCCESS            Operation completed successfully.
 708   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 709 **/
 710 EFI_STATUS
 711 EFIAPI
 712 Tpm2GetCapabilityLockoutCounter (
 713   OUT     UINT32                    *LockoutCounter
 714   );
 715
 716 /**
 717   This command returns the information of TPM LockoutInterval.
 718
 719   This function parse the value got from TPM2_GetCapability and return the LockoutInterval.
 720
 721   @param[out] LockoutInterval    The LockoutInterval of TPM.
 722
 723   @retval EFI_SUCCESS            Operation completed successfully.
 724   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 725 **/
 726 EFI_STATUS
 727 EFIAPI
 728 Tpm2GetCapabilityLockoutInterval (
 729   OUT     UINT32                    *LockoutInterval
 730   );
 731
 732 /**
 733   This command returns the information of TPM InputBufferSize.
 734
 735   This function parse the value got from TPM2_GetCapability and return the InputBufferSize.
 736
 737   @param[out] InputBufferSize    The InputBufferSize of TPM.
 738                                  the maximum size of a parameter (typically, a TPM2B_MAX_BUFFER)
 739
 740   @retval EFI_SUCCESS            Operation completed successfully.
 741   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 742 **/
 743 EFI_STATUS
 744 EFIAPI
 745 Tpm2GetCapabilityInputBufferSize (
 746   OUT     UINT32                    *InputBufferSize
 747   );
 748
 749 /**
 750   This command returns the information of TPM PCRs.
 751
 752   This function parse the value got from TPM2_GetCapability and return the PcrSelection.
 753
 754   @param[out] Pcrs    The Pcr Selection
 755
 756   @retval EFI_SUCCESS            Operation completed successfully.
 757   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 758 **/
 759 EFI_STATUS
 760 EFIAPI
 761 Tpm2GetCapabilityPcrs (
 762   OUT TPML_PCR_SELECTION      *Pcrs
 763   );
 764
 765 /**
 766   This command returns the information of TPM AlgorithmSet.
 767
 768   This function parse the value got from TPM2_GetCapability and return the AlgorithmSet.
 769
 770   @param[out] AlgorithmSet    The AlgorithmSet of TPM.
 771
 772   @retval EFI_SUCCESS            Operation completed successfully.
 773   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 774 **/
 775 EFI_STATUS
 776 EFIAPI
 777 Tpm2GetCapabilityAlgorithmSet (
 778   OUT     UINT32      *AlgorithmSet
 779   );
 780
 781 /**
 782   This command is used to check to see if specific combinations of algorithm parameters are supported.
 783
 784   @param[in]  Parameters              Algorithm parameters to be validated
 785
 786   @retval EFI_SUCCESS      Operation completed successfully.
 787   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 788 **/
 789 EFI_STATUS
 790 EFIAPI
 791 Tpm2TestParms (
 792   IN  TPMT_PUBLIC_PARMS           *Parameters
 793   );
 794
 795 /**
 796   This command allows the platform to change the set of algorithms that are used by the TPM.
 797   The algorithmSet setting is a vendor-dependent value.
 798
 799   @param[in]  AuthHandle              TPM_RH_PLATFORM
 800   @param[in]  AuthSession             Auth Session context
 801   @param[in]  AlgorithmSet            A TPM vendor-dependent value indicating the
 802                                       algorithm set selection
 803
 804   @retval EFI_SUCCESS      Operation completed successfully.
 805   @retval EFI_DEVICE_ERROR Unexpected device behavior.
 806 **/
 807 EFI_STATUS
 808 EFIAPI
 809 Tpm2SetAlgorithmSet (
 810   IN  TPMI_RH_PLATFORM          AuthHandle,
 811   IN  TPMS_AUTH_COMMAND         *AuthSession,
 812   IN  UINT32                    AlgorithmSet
 813   );
 814
 815 /**
 816   This command is used to start an authorization session using alternative methods of
 817   establishing the session key (sessionKey) that is used for authorization and encrypting value.
 818
 819   @param[in]  TpmKey             Handle of a loaded decrypt key used to encrypt salt.
 820   @param[in]  Bind               Entity providing the authValue.
 821   @param[in]  NonceCaller        Initial nonceCaller, sets nonce size for the session.
 822   @param[in]  Salt               Value encrypted according to the type of tpmKey.
 823   @param[in]  SessionType        Indicates the type of the session.
 824   @param[in]  Symmetric          The algorithm and key size for parameter encryption.
 825   @param[in]  AuthHash           Hash algorithm to use for the session.
 826   @param[out] SessionHandle      Handle for the newly created session.
 827   @param[out] NonceTPM           The initial nonce from the TPM, used in the computation of the sessionKey.
 828
 829   @retval EFI_SUCCESS            Operation completed successfully.
 830   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 831 **/
 832 EFI_STATUS
 833 EFIAPI
 834 Tpm2StartAuthSession (
 835   IN      TPMI_DH_OBJECT            TpmKey,
 836   IN      TPMI_DH_ENTITY            Bind,
 837   IN      TPM2B_NONCE               *NonceCaller,
 838   IN      TPM2B_ENCRYPTED_SECRET    *Salt,
 839   IN      TPM_SE                    SessionType,
 840   IN      TPMT_SYM_DEF              *Symmetric,
 841   IN      TPMI_ALG_HASH             AuthHash,
 842      OUT  TPMI_SH_AUTH_SESSION      *SessionHandle,
 843      OUT  TPM2B_NONCE               *NonceTPM
 844   );
 845
 846 /**
 847   This command causes all context associated with a loaded object or session to be removed from TPM memory.
 848
 849   @param[in]  FlushHandle        The handle of the item to flush.
 850
 851   @retval EFI_SUCCESS            Operation completed successfully.
 852   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 853 **/
 854 EFI_STATUS
 855 EFIAPI
 856 Tpm2FlushContext (
 857   IN      TPMI_DH_CONTEXT           FlushHandle
 858   );
 859
 860 /**
 861   This command includes a secret-based authorization to a policy.
 862   The caller proves knowledge of the secret value using an authorization
 863   session using the authValue associated with authHandle.
 864
 865   @param[in]  AuthHandle         Handle for an entity providing the authorization
 866   @param[in]  PolicySession      Handle for the policy session being extended.
 867   @param[in]  AuthSession        Auth Session context
 868   @param[in]  NonceTPM           The policy nonce for the session.
 869   @param[in]  CpHashA            Digest of the command parameters to which this authorization is limited.
 870   @param[in]  PolicyRef          A reference to a policy relating to the authorization.
 871   @param[in]  Expiration         Time when authorization will expire, measured in seconds from the time that nonceTPM was generated.
 872   @param[out] Timeout            Time value used to indicate to the TPM when the ticket expires.
 873   @param[out] PolicyTicket       A ticket that includes a value indicating when the authorization expires.
 874
 875   @retval EFI_SUCCESS            Operation completed successfully.
 876   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 877 **/
 878 EFI_STATUS
 879 EFIAPI
 880 Tpm2PolicySecret (
 881   IN      TPMI_DH_ENTITY            AuthHandle,
 882   IN      TPMI_SH_POLICY            PolicySession,
 883   IN      TPMS_AUTH_COMMAND         *AuthSession, OPTIONAL
 884   IN      TPM2B_NONCE               *NonceTPM,
 885   IN      TPM2B_DIGEST              *CpHashA,
 886   IN      TPM2B_NONCE               *PolicyRef,
 887   IN      INT32                     Expiration,
 888   OUT     TPM2B_TIMEOUT             *Timeout,
 889   OUT     TPMT_TK_AUTH              *PolicyTicket
 890   );
 891
 892 /**
 893   This command allows options in authorizations without requiring that the TPM evaluate all of the options.
 894   If a policy may be satisfied by different sets of conditions, the TPM need only evaluate one set that
 895   satisfies the policy. This command will indicate that one of the required sets of conditions has been
 896   satisfied.
 897
 898   @param[in] PolicySession      Handle for the policy session being extended.
 899   @param[in] HashList           the list of hashes to check for a match.
 900
 901   @retval EFI_SUCCESS            Operation completed successfully.
 902   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 903 **/
 904 EFI_STATUS
 905 EFIAPI
 906 Tpm2PolicyOR (
 907   IN TPMI_SH_POLICY           PolicySession,
 908   IN TPML_DIGEST              *HashList
 909   );
 910
 911 /**
 912   This command indicates that the authorization will be limited to a specific command code.
 913
 914   @param[in]  PolicySession      Handle for the policy session being extended.
 915   @param[in]  Code               The allowed commandCode.
 916
 917   @retval EFI_SUCCESS            Operation completed successfully.
 918   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 919 **/
 920 EFI_STATUS
 921 EFIAPI
 922 Tpm2PolicyCommandCode (
 923   IN      TPMI_SH_POLICY            PolicySession,
 924   IN      TPM_CC                    Code
 925   );
 926
 927 /**
 928   This command returns the current policyDigest of the session. This command allows the TPM
 929   to be used to perform the actions required to precompute the authPolicy for an object.
 930
 931   @param[in]  PolicySession      Handle for the policy session.
 932   @param[out] PolicyHash         the current value of the policyHash of policySession.
 933
 934   @retval EFI_SUCCESS            Operation completed successfully.
 935   @retval EFI_DEVICE_ERROR       The command was unsuccessful.
 936 **/
 937 EFI_STATUS
 938 EFIAPI
 939 Tpm2PolicyGetDigest (
 940   IN      TPMI_SH_POLICY            PolicySession,
 941      OUT  TPM2B_DIGEST              *PolicyHash
 942   );
 943
 944 //
 945 // Help function
 946 //
 947
 948 /**
 949   Copy AuthSessionIn to TPM2 command buffer.
 950
 951   @param [in]  AuthSessionIn   Input AuthSession data
 952   @param [out] AuthSessionOut  Output AuthSession data in TPM2 command buffer
 953
 954   @return AuthSession size
 955 **/
 956 UINT32
 957 EFIAPI
 958 CopyAuthSessionCommand (
 959   IN      TPMS_AUTH_COMMAND         *AuthSessionIn, OPTIONAL
 960   OUT     UINT8                     *AuthSessionOut
 961   );
 962
 963 /**
 964   Copy AuthSessionIn from TPM2 response buffer.
 965
 966   @param [in]  AuthSessionIn   Input AuthSession data in TPM2 response buffer
 967   @param [out] AuthSessionOut  Output AuthSession data
 968
 969   @return AuthSession size
 970 **/
 971 UINT32
 972 EFIAPI
 973 CopyAuthSessionResponse (
 974   IN      UINT8                      *AuthSessionIn,
 975   OUT     TPMS_AUTH_RESPONSE         *AuthSessionOut OPTIONAL
 976   );
 977
 978 /**
 979   Return size of digest.
 980
 981   @param[in] HashAlgo  Hash algorithm
 982
 983   @return size of digest
 984 **/
 985 UINT16
 986 EFIAPI
 987 GetHashSizeFromAlgo (
 988   IN TPMI_ALG_HASH    HashAlgo
 989   );
 990
 991 /**
 992   This function get digest from digest list.
 993
 994   @param HashAlg    digest algorithm
 995   @param DigestList digest list
 996   @param Digest     digest
 997
 998   @retval EFI_SUCCESS   Sha1Digest is found and returned.
 999   @retval EFI_NOT_FOUND Sha1Digest is not found.
1000 **/
1001 EFI_STATUS
1002 EFIAPI
1003 GetDigestFromDigestList(
1004   IN TPMI_ALG_HASH      HashAlg,
1005   IN TPML_DIGEST_VALUES *DigestList,
1006   IN VOID               *Digest
1007   );
1008
1009 #endif